How to fix CVE-2019-25419?

Within 24 hours: inventory all instances of Comodo Dome Firewall 2.7.0 in production and restrict administrative access to the schedule endpoint to trusted networks only. Within 7 days: implement WAF rules to sanitize input to the schedule endpoint and disable the scheduling feature if operationally feasible. Within 30 days: evaluate migration to alternative firewall solutions or contact Comodo for patch availability; establish a formal exception process with enhanced monitoring for any systems that must remain on this version.

Is Dome Firewall affected by CVE-2019-25419?

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that could allow attackers to inject malicious code into the firewall management interface, potentially compromising administrative accounts and enabling lateral movement within the network.

CVE-2019-25419

HIGH

2026-02-19 [email protected]

7.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 17:17 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 13:16 nvd

HIGH 7.2

Description

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. Attackers can submit POST requests with JavaScript payloads in the SCHNAME parameter to execute arbitrary code in administrators' browsers when the schedule page is accessed.

Analysis

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. [CVSS 7.2 HIGH]

Technical Context

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the SCHNAME component of Dome Firewall. Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. Attackers can submit POST requests with JavaScript payloads in the SCHNAME parameter to execute arbitrary code in administrators' browsers when the schedule page is accessed.

Affected Products

Vendor: Comodo. Product: Dome Firewall. Component: SCHNAME.

Remediation

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +36

POC: +20

CVE-2019-25419 vulnerability details – vuln.today

Back

CVE-2019-25419

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2019-25419

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code