CVE-2019-25409

Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via routing

MEDIUM 5.1EPSS 0.4%

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the destination parameter. Attackers can send POST requests to the routing endpoint with script payloads in the destination parameter to execute arbitrary JavaScript in users' browsers.

Affected: Comodo · Comodo Dome Firewall
CVSS v4.0 VULNCHECK: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULNCHECK: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.39% chance of exploitation in the next 30 days, 32nd percentile
Published: 2026-02-19
Updated: 2026-05-24

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/46408

Security advisories

https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-…
https://cdome.comodo.com/firewall

References

CVE Record
NVD entry