CVE-2019-25412 - Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP_SERVER_LIST

Back Back to CVE browser

MEDIUM

Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via NTP_SERVER_LIST

Published Feb 19, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting unsanitized input through the NTP_SERVER_LIST parameter. Attackers can send POST requests to the /korugan/time endpoint with script payloads in the NTP_SERVER_LIST parameter to execute arbitrary JavaScript in users' browsers.

Affected products

Vendor Comodo Product Comodo Dome Firewall Default
n/a
- Version
  2.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comodo

Comodo Dome Firewall

n/a

Version	Status	Constraints
2.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://cdome.comodo.com/firewall/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19693
Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278
productNot Applicable
https://www.exploit-db.com/exploits/46408
exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-ntpserverlist
third-party-advisoryBroken Link

Link	Providers	Tags
https://cdome.comodo.com/firewall/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19693		Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278		productNot Applicable
https://www.exploit-db.com/exploits/46408		exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-ntpserverlist		third-party-advisoryBroken Link