PT-2026-8367 · Smoothwall · Smoothwall Express

Ozer Goker · CVE-2019-25384 · Publicado 2026-02-16 · Atualizado 2026-02-16

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple reflected cross-site scripting issues within the portfw.cgi script. Attackers can inject malicious scripts through unvalidated parameters by submitting POST requests. Specifically, script payloads can be included in the EXT, SRC PORT SEL, SRC PORT, DEST IP, DEST PORT SEL, or COMMENT parameters. Successful exploitation allows attackers to execute arbitrary JavaScript in users' browsers.

Recommendations Apply input validation and sanitization to all parameters accepted by the portfw.cgi script, including EXT, SRC PORT SEL, SRC PORT, DEST IP, DEST PORT SEL, and COMMENT.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25384

Produtos afetados

Smoothwall Express

Referências · 6

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• http://smoothwall.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25384 · Nota de Segurança
• https://vulncheck.com/advisories/smoothwall-express-portfwcgi-cross-site-scripting · Nota
• https://osv.dev/vulnerability/CVE-2019-25384 · Aviso do Fabricante
• https://t.me/CVEtracker/44836 · Publicação no Telegram