Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-25406: Comodo Dome Firewall 2.7.0 allows attackers to inject malicious scripts

CVE-2019-25406 · published 8 months ago

Summary

Comodo Dome Firewall 2.7.0 is vulnerable to a security weakness that lets attackers inject malicious code into users' browsers. This can happen if a user visits a specially crafted website or clicks on a link sent by an attacker. To stay safe, update to the latest version of Comodo Dome Firewall as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
comodo	dome_firewall	<= 2.7.0 `cpe:2.3:a:comodo:dome_firewall::::::::`

Original advisory text

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the organization parameter. Attackers can send POST requests to the korugan/cmclient endpoint with script payloads in the organization parameter to execute arbitrary JavaScript in users' browsers.

References

https://cdome.comodo.com/firewall/ Product
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=92... Not Applicable
https://www.exploit-db.com/exploits/46408 Exploit VDB Entry
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-s... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published19 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2019-25406 · NVD

Track software like this

Free during beta