CVE-2019-25416 - Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via device Parameter

Back Back to CVE browser

MEDIUM

Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via device Parameter

Published Feb 19, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.36%

Description

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through the device parameter. Attackers can send POST requests to the QoS devices management endpoint with script payloads in the device parameter to execute arbitrary JavaScript in users' browsers.

Affected products

Vendor Comodo Product Comodo Dome Firewall Default
n/a
- Version
  2.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comodo

Comodo Dome Firewall

n/a

Version	Status	Constraints
2.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://cdome.comodo.com/firewall/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19688
Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278
productNot Applicable
https://www.exploit-db.com/exploits/46408
exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-device-parameter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://cdome.comodo.com/firewall/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19688		Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278		productNot Applicable
https://www.exploit-db.com/exploits/46408		exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-device-parameter		third-party-advisoryThird Party Advisory