Vulnerability · Published Feb 24, 2025 · Assigned by VulDB
CVE-2025-1617Netis WF2780 Wireless 2.4G Menu cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in WF2780 from Netis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.3%top 76.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
References
- VDB-296607 | Netis WF2780 Wireless 2.4G Menu cross site scripting vdb-entry, technical-description
- VDB-296607 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #501472 | Netis WF2780 V2.1.41925 Cross Site Scripting third-party-advisory