What is the CVSS score of CVE-2019-25419?

CVE-2019-25419 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dome Firewall are affected by CVE-2019-25419?

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that could allow attackers to inject malicious code into the firewall management interface, potentially compromising…

Is there a public PoC exploit available for CVE-2019-25419?

Yes, a public proof-of-concept exploit is available for CVE-2019-25419. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25419?

Within 24 hours: inventory all instances of Comodo Dome Firewall 2.7.0 in production and restrict administrative access to the schedule endpoint to trusted networks only. Within 7 days: implement WAF rules to sanitize input to the schedule endpoint and disable the scheduling feature if operationally feasible. Within 30 days: evaluate migration to alternative firewall solutions or contact Comodo for patch availability; establish a formal exception process with enhanced monitoring for any systems that must remain on this version.

Dome Firewall CVE-2019-25419

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-19 disclosure@vulncheck.com

XSS Dome Firewall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 17:17 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 13:16 nvd

HIGH 7.2

DescriptionCVE.org

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. Attackers can submit POST requests with JavaScript payloads in the SCHNAME parameter to execute arbitrary code in administrators' browsers when the schedule page is accessed.

AnalysisAI

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. [CVSS 7.2 HIGH]

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the SCHNAME component of Dome Firewall. Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. Attackers can submit POST requests with JavaScript payloads in the SCHNAME parameter to execute arbitrary code in administrators' browsers when the schedule page is accessed.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.