CVE-2025-9119

Executive Summary

CVE-2025-9119 is a publicly disclosed, unauthenticated stored cross-site scripting (XSS) vulnerability affecting the Netis WF2419 router (firmware version 1.2.29433). The flaw resides in the Wireless Settings page (/index.htm), where the SSID parameter is not sanitized before being rendered. An attacker can inject arbitrary JavaScript via a crafted SSID, such as <img/src/onerror=prompt(8)>, leading to script execution in the context of the admin’s browser. With a CVSS score of 2.4 (Low), the impact is limited to client-side attacks, but the lack of a vendor patch and public exploit availability elevates the risk for exposed devices. No supply chain or package ecosystem is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.4 (Low)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the stored XSS.
• User Interaction: Required (UI:R) – An admin must view the Wireless Settings page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Attacker can modify page content or perform actions on behalf of the admin.
• Availability Impact: None (A:N)
• Threat Level: Low, but elevated due to public exploit and unpatched status.

Deep Dive & Mechanics

The vulnerability is a classic stored cross-site scripting (XSS) in the Netis WF2419 router’s web interface. The Wireless Settings page (/index.htm) accepts an SSID parameter without proper input validation or output encoding. When an attacker sets the SSID to a malicious payload like <img/src/onerror=prompt(8)>, the router stores this value in its configuration. Subsequently, when an administrator accesses the Wireless Settings page, the browser interprets the injected HTML/JavaScript, executing the attacker’s code.

Root Cause: The SSID field is not sanitized or encoded before being rendered in the HTML response. The router’s firmware does not implement Content Security Policy (CSP) or other XSS mitigations.

Attack Flow:

1. Attacker connects to the router’s Wi-Fi or accesses the admin interface (if exposed).
2. Attacker sets the SSID to a malicious payload via the Wireless Settings page.
3. The router stores the payload in its configuration.
4. An admin visits /index.htm to view or modify wireless settings.
5. The browser renders the malicious SSID, executing the JavaScript.
6. The attacker can steal session cookies, perform actions on behalf of the admin, or redirect to malicious sites.

Vulnerable vs. Patched Code

Vulnerable Code (Netis WF2419 firmware 1.2.29433): The SSID parameter is directly echoed into the HTML without sanitization. Example (pseudo-code):

<input type="text" name="ssid" value="<%= request.getParameter("SSID") %>">

Patched Code (Hypothetical): The SSID should be HTML-encoded before rendering:

<input type="text" name="ssid" value="<%= HtmlEncoder.encode(request.getParameter("SSID")) %>">

No official patch is available from Netis.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Netis WF2419 router with firmware 1.2.29433.
• Access to the router’s admin interface (default credentials often admin/admin).
• A web browser or tool like curl to send the malicious payload.

Exploit Steps:

1. Log in to the router’s admin interface.
2. Navigate to Wireless Settings (/index.htm).
3. Set the SSID to: <img src=x onerror=alert('XSS')>
4. Save the configuration.
5. When an admin views the Wireless Settings page, the XSS triggers.

Proof-of-Concept (PoC) using curl:

curl -X POST http://<router-ip>/index.htm \
  -d "SSID=<img/src/onerror=alert(1)>&submit=Save"

Expected Result: An alert box with "1" appears when the admin reloads the Wireless Settings page.

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP requests to /index.htm for unusual SSID values containing <script>, <img, or onerror patterns.
• Use network monitoring to detect outbound connections from the router to unknown domains (potential data exfiltration).

Hardening:

• Disable remote administration of the router.
• Change default admin credentials.
• Apply network segmentation to isolate the router from critical assets.
• If possible, replace the router with a vendor-supported model.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /index.htm with SSID containing HTML/JavaScript payloads.
  • Outbound connections from the router to IPs/domains not associated with normal firmware updates.
• Host IOCs:
  • Router configuration showing SSID with embedded <img, <script>, or onerror attributes.
  • Unexpected JavaScript execution in the admin’s browser when accessing Wireless Settings.
• File IOCs:
  • Modified configuration files on the router (if accessible) containing XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2025_9119_Netis_XSS {
    meta:
        description = "Detects XSS payload in SSID parameter for CVE-2025-9119"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9119"
    strings:
        $xss_payload = /<[^>]*onerror\s*=[^>]*>/
        $ssid_param = "SSID="
    condition:
        $ssid_param and $xss_payload
}

Sigma Rule

title: Netis WF2419 XSS via SSID Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against Netis WF2419 router Wireless Settings page
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-9119
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/index.htm'
        cs-uri-query|contains: 'SSID='
        cs-uri-query|re: '<[^>]*onerror\s*='
    condition: selection
falsepositives:
    - Legitimate SSID names containing similar patterns (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-9119 Netis WF2419 XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.htm"; http_uri;
    content:"SSID="; http_client_body;
    pcre:"/<[^>]*onerror\s*=[^>]*>/i";
    reference:cve,2025-9119;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Administration: Ensure the router’s web interface is not accessible from the internet.
2. Change Default Credentials: Use strong, unique passwords for admin access.
3. Network Segmentation: Place the router in a separate VLAN with limited access to internal resources.
4. Monitor Logs: Review router logs for unusual SSID changes or access attempts.

Long-Term Fix:

• Vendor Patch: No patch is available. Contact Netis support or consider replacing the device with a supported model.
• Firmware Update: If a future firmware update is released, apply it immediately.
• Workaround: Implement a reverse proxy with input validation to sanitize SSID parameters before they reach the router.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.