PT-2026-29061 · Smoothwall · Smoothwall Express

Alex Williams + 1 · CVE-2026-26352 · Publicado 2026-03-30 · Atualizado 2026-03-31

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express versions prior to 3.1 Update 13

Description Smoothwall Express is affected by a stored cross-site scripting issue in the /cgi-bin/vpnmain.cgi script. The issue stems from insufficient input validation of the VPN IP parameter. An authenticated attacker can inject malicious JavaScript code through VPN configuration settings. This code will then execute in the browsers of other users when they access the affected page.

Recommendations Update Smoothwall Express to version 3.1 Update 13 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-26352

Produtos afetados

Smoothwall Express

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-26352 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039004520970138107 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2038683083898023941 · Publicação no Twitter
• https://community.smoothwall.org/forum/viewtopic.php?t=45095 · Correção, Aviso do Fabricante
• https://vulncheck.com/advisories/smoothwall-express-stored-xss-in-vpnmain-cgi-via-vpn-ip-parameter · Nota