Smoothwall CVE-2026-27508

This is a moderate-priority vulnerability with context-dependent real-world risk. The CVSS v4.0 score of 5.1 reflects low attack complexity and no authentication requirement, but the impact scope is limited (only user-level JavaScript execution, no server-side code execution or denial of service). The attack vector is network-accessible without privileges, but requires user interaction (UI:A), which is a significant practical limiting factor. The CVSS vector indicates no impact to system confidentiality, integrity, or availability at the system level-only session/browser-level scope impact. EPSS exploitation probability data is not available. The vulnerability does not appear on CISA's KEV list, and no public exploit code has been identified. This suggests lower real-world exploitation pressure compared to unauthenticated remote code execution or authentication bypass flaws. However, in environments where Smoothwall administrators frequently access the web interface via untrusted networks or email campaigns, social engineering delivery of the malicious link remains a credible attack vector. Organizations should prioritize patching based on exposure of the Smoothwall web interface to untrusted users and the sensitivity of data accessible through administrator accounts.

An attacker crafts a phishing email targeting Smoothwall administrators containing a link such as http://[smoothwall-ip]/redirect.cgi?url=javascript:alert(document.cookie). When an administrator clicks the link, the redirect endpoint reflects the malicious javascript: URI back to the browser without sanitization, causing the browser to execute arbitrary JavaScript in the context of the Smoothwall web interface session. The attacker could steal authentication tokens, modify firewall rules, or exfiltrate sensitive logs depending on the admin's session privileges.