CVE-2026-108898 Netis WF2409E Wireless Settings cross site scripting

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was...

CVE-2026-108898

A cross-site scripting (XSS) vulnerability exists in the Wireless Settings component of the Netis WF2409E (version 3.3.42541). The root cause is the improper neutralization of input when the SSID argument is manipulated, which may be exploited remotely. The documents indicate that an exploit is n...

PT-2026-110619

Name of the Vulnerable Software and Affected Versions Netis WF2409E version 3.3.42541 Description A remote cross-site scripting issue exists within the Wireless Settings component. This occurs when the SSID argument is manipulated, allowing an attacker to execute malicious scripts in the context ...

CVE-2026-108898: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was...

Netis WF2409E Cross-Site Scripting Vulnerability

The Netis WF2409E 3.3.42541 version has a security vulnerability. This vulnerability stems from improper handling of the SSID parameter by an unknown function in the Wireless Settings component. It is vulnerable to cross-site scripting attacks, and attackers can exploit this vulnerability remotel...

Netis Router Info Disclosure (CVE-2024-48455)

Exploits CVE-2024-48455 in Netis WiFi routers: unauthenticated POST to skkget.cgi with modename/wllink leaks device stats and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Netis router skkget.cgi info disclosure CVE-2024-48455.""" from kittysploit import from...

CVE-2026-61516

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

CVE-2026-61517

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61517

Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler . An authenticated administrator can inject into the IpAddr parameter, which is interpolated directly into a shell command executed via system() . Input validation...

EUVD-2026-72808

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61516 Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

EUVD-2026-72805

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

CVE-2026-61516

The Netis NX10 (firmware V4.0.1.5808 and V3.0.0.4142) contains an information disclosure vulnerability in the sysinfo diagnostic endpoint of its web management interface. An unauthenticated attacker can retrieve the administrator password by sending a request to this action without a valid sessio...

CVE-2026-61516 Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

PT-2026-87095

Name of the Vulnerable Software and Affected Versions Netis NX10 version V4.0.1.5808 Netis NX10 version V3.0.0.4142 Description An information disclosure issue exists in the web management interface that allows unauthenticated attackers to retrieve the administrator password. This is achieved by...

CVE-2026-61517: Improper Neutralization of Special Elements used in an OS Command

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

PT-2026-87096

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61516: Insufficiently Protected Credentials

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...