Wf2409E
Monthly
Stored cross-site scripting (XSS) in the Netis WF2409E router (firmware 3.3.42541) allows an authenticated attacker with access to the web management interface to inject a malicious script into the Wireless Settings SSID parameter, which then executes in the browser of an administrator who loads that page. The exploit is publicly available, and while this raises exploit maturity (E:P), the issue is rated low priority because it requires valid credentials (PR:L) and depends on administrator interaction (UI:R or UI:P), with impact limited to script execution in the admin's browser context (integrity-low; no confidentiality or availability impact). No vendor patch has been released, as the vendor did not respond to the disclosure.
Stored cross-site scripting (XSS) in the Netis WF2409E router (firmware 3.3.42541) allows an authenticated attacker with access to the web management interface to inject a malicious script into the Wireless Settings SSID parameter, which then executes in the browser of an administrator who loads that page. The exploit is publicly available, and while this raises exploit maturity (E:P), the issue is rated low priority because it requires valid credentials (PR:L) and depends on administrator interaction (UI:R or UI:P), with impact limited to script execution in the admin's browser context (integrity-low; no confidentiality or availability impact). No vendor patch has been released, as the vendor did not respond to the disclosure.