PT-2026-8376 · Smoothwall · Smoothwall Express

Ozer Goker · Published 2026-02-16 · Updated 2026-02-16 · CVE-2019-25394

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple stored cross-site scripting issues within the modem.cgi script. Attackers can inject malicious scripts through POST parameters. Specifically, crafted payloads can be submitted in parameters such as INIT, HANGUP, SPEAKER ON, SPEAKER OFF, TONE DIAL, and PULSE DIAL. When the stored data is retrieved, this allows for the execution of arbitrary JavaScript in users' browsers.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25394

Affected Products

Smoothwall Express

References · 6

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25394 · Security Note
• https://vulncheck.com/advisories/smoothwall-express-modemcgi-cross-site-scripting · Note
• http://smoothwall.org · Note
• https://t.me/CVEtracker/44845 · Telegram Post