What is the CVSS score of CVE-2019-25405?

CVE-2019-25405 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dome Firewall are affected by CVE-2019-25405?

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that could allow attackers to inject malicious scripts and compromise the security infrastructure protecting your…

Is there a public PoC exploit available for CVE-2019-25405?

Yes, a public proof-of-concept exploit is available for CVE-2019-25405. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25405?

Within 24 hours: Identify all instances of Comodo Dome Firewall 2.7.0 in your environment and document their criticality and network exposure. Within 7 days: Implement compensating controls (WAF rules blocking script injection, restrict administrative access to firewall UI, disable the license parameter input if unused, network segmentation). Within 30 days: Contact Comodo for patch availability status; evaluate alternative firewall solutions or evaluate upgrading to a patched version when available.

Dome Firewall CVE-2019-25405

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-19 disclosure@vulncheck.com

XSS Dome Firewall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 17:20 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 13:16 nvd

HIGH 7.2

DescriptionCVE.org

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the newLicense parameter. Attackers can send POST requests to the license activation endpoint with script payloads in the newLicense field to execute arbitrary JavaScript in administrators' browsers.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Dome Firewall. Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the newLicense parameter. Attackers can send POST requests to the license activation endpoint with script payloads in the newLicense field to execute arbitrary JavaScript in administrators' browsers.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

CVE-2019-25405 vulnerability details – vuln.today

Back

Dome Firewall CVE-2019-25405

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code