Netis WF2409E CVE-2026-108898

Exploitation requires the attacker to reach and authenticate to the router's web management interface and have the ability to modify the Wireless Settings SSID argument (PR:L), and it requires a victim administrator to subsequently load the Wireless Settings page for the stored payload to fire (UI:P). It is therefore NOT remote-unauthenticated: the limiting factors are the need for valid credentials or configuration access to the device and the dependency on admin interaction. Impact is confined to script execution in the admin's browser context (integrity-low); there is no confidentiality or availability impact per the vector.

This is a low-priority issue despite being publicly exploitable. The CVSS 4.0 base score is only 2.0, and the vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) tells a consistent story: although the attack is network-reachable, it requires low-level privileges (PR:L - i.e., the ability to authenticate to the router and change wireless settings) and passive user interaction (UI:P - an administrator must subsequently view the affected page), and the only impact is a low-integrity effect with no confidentiality or availability loss. The 'E:P' flag in the vector corroborates the description's statement that a proof-of-concept is public, so exploitation status is 'publicly available exploit code exists' - but this must NOT be conflated with active exploitation: there is no CISA KEV listing and no EPSS score provided, so widespread or automated exploitation is not evidenced. The practical threat is self-limiting because the SSID field is set by someone who already has administrative/configuration access to the device, making this closer to a stored-XSS-against-oneself or an insider/second-admin scenario than a remote-unauthenticated takeover. Net assessment: real but minor; a stored XSS in a consumer router admin panel with authentication and user-interaction prerequisites, confirmed only by VulDB with no vendor response.

An attacker who can authenticate to the Netis WF2409E web interface (or a lower-privileged user with wireless-configuration rights) sets the wireless SSID to a value containing a malicious script payload. When an administrator later opens the Wireless Settings page, the stored script executes in their browser session. A public proof-of-concept exists, but exploitation requires both configuration access and an admin viewing the affected page.