This vulnerability (CVE-2024-9477) in AirTies Air4443 Firmware is an instance of CWE-79, where improper neutralization of input during web page generation leads to Cross-Site Scripting (XSS). The CVSS 4.0 base score is 4.6 (medium), indicating that exploitation requires local access with high privileges and does not involve user interaction. The vendor has confirmed the product is End-of-Life and End-of-Support, and no patch or official remediation is provided. The vulnerability affects firmware versions through 14102024. No known exploits have been reported.

Successful exploitation could allow an attacker with high privileges and local access to execute malicious scripts in the context of the device's web interface. This could potentially lead to unauthorized actions within the device management interface or disclosure of sensitive information. However, the impact is limited by the requirement for high privileges and local access, and no known exploitation in the wild has been reported.

Since the product is End-of-Life and End-of-Support, no official patch or remediation is available. Users should consider replacing the affected AirTies Air4443 device with a supported model to mitigate this vulnerability. Network segmentation and limiting administrative access to trusted users may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for any updates, though none are currently available.