CVE-2026-108898: Cross Site Scripting in Netis WF2409E

This vulnerability in Netis WF2409E version 3.3.42541 affects the Wireless Settings component, where manipulation of the SSID argument leads to cross-site scripting (XSS). The flaw allows remote attackers to inject malicious scripts, potentially impacting users who access the affected interface. The CVSS 4.0 base score is 5.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vendor was contacted but did not respond, and no official patch or remediation guidance is available. Exploit code is publicly available.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected device's web interface, potentially allowing attackers to hijack user sessions or perform unauthorized actions via the router's management interface. The vulnerability requires user interaction and low privileges, and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should limit access to the router's management interface, especially from untrusted networks, and consider disabling wireless SSID configuration via the web interface if possible until a fix is released.