What is the CVSS score of CVE-2019-25422?

CVE-2019-25422 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Dome Firewall are affected by CVE-2019-25422?

Comodo Dome Firewall 2.7.0 contains a cross-site scripting vulnerability that could allow attackers to execute malicious code through the firewall's web interface, potentially compromising network…

Is there a public PoC exploit available for CVE-2019-25422?

Yes, a public proof-of-concept exploit is available for CVE-2019-25422. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25422?

Within 24 hours: Identify all systems running Comodo Dome Firewall 2.7.0 and assess exposure (prioritize internet-facing instances). Within 7 days: Implement WAF rules to filter malicious payloads targeting the vpnfw endpoint, restrict administrative access to trusted IP ranges only, and disable remote management if not required. Within 30 days: Upgrade to a patched version when available, or migrate to an alternative firewall solution if no patch timeline is provided by Comodo.

Dome Firewall CVE-2019-25422

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-19 disclosure@vulncheck.com

XSS Dome Firewall

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 13:16 nvd

HIGH 7.2

DescriptionCVE.org

Comodo Dome Firewall 2.7.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the vpnfw endpoint. Attackers can submit POST requests with script payloads in the target parameter for reflected XSS or the remark parameter for stored XSS to execute arbitrary JavaScript in administrator browsers.

AnalysisAI

Comodo Dome Firewall 2.7.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the vpnfw endpoint. [CVSS 7.2 HIGH]

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the vpnfw component of Dome Firewall. Comodo Dome Firewall 2.7.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through the vpnfw endpoint. Attackers can submit POST requests with script payloads in the target parameter for reflected XSS or the remark parameter for stored XSS to execute arbitrary JavaScript in administrator browsers.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.