The vulnerability resides in the Wireless Settings component of Netis WF2409E firmware 3.3.42541. A malformed SSID parameter can be crafted to inject arbitrary script that executes in the browser context of anyone who opens the configuration page. The flaw is a classic reflected XSS (CWE‑79) that can also lead to arbitrary code concatenation via the input (CWE‑94). Remote actors can trigger the exploit by sending a crafted HTTP request to the device's web interface. The public exploit code is available and the vendor has not provided a fix.

Netis WF2409E routers running firmware version 3.3.42541 (and any other builds containing the same vulnerable Wireless Settings component).

The CVSS scoring of 5.1 places the issue in the moderate range. With no EPSS data available and the vulnerability not listed in the CISA KEV catalog, the likelihood of immediate exploitation remains unknown, but because the exploit is public, a determined attacker could mount an attack. Remote delivery via the web interface is the likely vector, with no local privilege escalation involved. The primary risk is in the confidentiality and integrity of administrative sessions and potential download of malicious payloads through a phishing‑like window.