Vulnerability · Published Aug 18, 2025 · Assigned by VulDB

CVE-2025-9119Netis WF2419 Wireless Settings index.htm cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in WF2419 from Netis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Page. This manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Netis	WF2419	1.2.29433

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-320456 | Netis WF2419 Wireless Settings index.htm cross site scripting vdb-entry, technical-description
VDB-320456 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #628410 | Netis WF2419 V1.2.29433 Cross Site Scripting third-party-advisory