CVE-2026-108898
Received Received - Intake

Cross-Site Scripting in Netis WF2409E Wireless Settings

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108898
EUVD
EUVD-2026-97484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netis WF2409E 3.3.42541

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Netis WF2409E version 3.3.42541. It involves manipulation of the SSID argument in the Wireless Settings component, allowing attackers to inject malicious scripts. The attack can be executed remotely and the exploit is publicly available.

Detection Guidance

Detecting this vulnerability requires checking for Netis WF2409E devices with firmware version 3.3.42541. Scan your network for devices with the SSID parameter vulnerable to XSS. Use tools like nmap to identify Netis devices and inspect their wireless settings for exposed SSID fields.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser when they access the affected device's interface. This may lead to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a reflected cross-site scripting (XSS) flaw in Netis WF2409E's wireless settings. However, if exploited, it could potentially lead to unauthorized access or data exposure, which may indirectly impact compliance depending on the system's use case and data processed.

Mitigation Strategies

Immediately update the firmware of Netis WF2409E devices to the latest version. Disable remote access to wireless settings if possible. Monitor network traffic for suspicious XSS attempts targeting the SSID parameter. Consider isolating affected devices from critical network segments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart