Cross-Site Scripting Vulnerability in Netis WF2419 Wireless Settings

CVE-2025-9119

What is CVE-2025-9119?

A Cross-Site Scripting vulnerability has been identified in the Netis WF2419 wireless router, specifically within the Wireless Settings Page located at /index.htm. This vulnerability arises due to improper handling of the SSID parameter, allowing an attacker to inject malicious scripts. An example of the exploit involves using the input <img/src/onerror=prompt(8)> to execute arbitrary JavaScript in the context of an unsuspecting user's browser. Consequently, this could lead to remote exploitation, as an attacker can potentially execute harmful scripts without user consent. This issue was publicly disclosed, yet the vendor did not respond to initial notifications.

References