What is the CVSS score of CVE-2019-25395?

CVE-2019-25395 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Smoothwall Express are affected by CVE-2019-25395?

Smoothwall Express 3.1-SP4 installations are vulnerable to stored cross-site scripting attacks that could allow attackers to compromise user sessions and steal administrative credentials.

Is there a public PoC exploit available for CVE-2019-25395?

Yes, a public proof-of-concept exploit is available for CVE-2019-25395. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25395?

Within 24 hours: Inventory all Smoothwall Express deployments and restrict administrative access to trusted networks only. Within 7 days: Implement Web Application Firewall rules to block malicious input to preferences.cgi parameters (HOSTNAME, KEYMAP, OPENNESS) and monitor access logs for exploitation attempts. Within 30 days: Evaluate migration to alternative firewall solutions or contact Smoothwall for emergency patching, as no official patch is currently available.

Smoothwall Express CVE-2019-25395

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-16 disclosure@vulncheck.com

XSS Smoothwall Express Smoothwall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 20, 2026 - 16:31 vuln.today

Public exploit code

CVE Published

Feb 16, 2026 - 18:19 nvd

HIGH 7.2

DescriptionCVE.org

Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Smoothwall Express. Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.