CVE-2019-25380: Smoothwall Express DHCP CGI XSS Flaw

CVE-2019-25380 Overview

CVE-2019-25380 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Smoothwall Express 3.1-SP4-polar-x86_64-update9. The vulnerability exists in the dhcp.cgi script, which fails to properly sanitize user-supplied input across multiple parameters. This allows attackers to inject and execute arbitrary JavaScript code in the context of authenticated user sessions.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, or administrative account compromise on Smoothwall firewall appliances.

Affected Products

Smoothwall Express 3.1-SP4-polar-x86_64-update9
Smoothwall Express 3.1 (earlier versions may also be affected)

Discovery Timeline

2026-02-16 - CVE CVE-2019-25380 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2019-25380

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The dhcp.cgi script in Smoothwall Express accepts user input through POST requests and reflects this input back to the browser without proper encoding or sanitization. The network-based attack vector requires user interaction, as victims must be tricked into submitting a malicious request or clicking a crafted link.

The vulnerability affects the DHCP configuration interface, which is typically accessible to authenticated administrators. Successful exploitation could allow attackers to perform actions on behalf of administrators, steal session tokens, or modify firewall configurations.

Root Cause

The root cause is improper input validation and output encoding in the dhcp.cgi CGI script. The script processes multiple DHCP-related configuration parameters without sanitizing special characters that have meaning in HTML and JavaScript contexts. When user-supplied data containing script tags or event handlers is echoed back in the HTTP response, browsers interpret and execute the injected code.

Attack Vector

Attackers can exploit this vulnerability by crafting malicious POST requests to the dhcp.cgi endpoint with JavaScript payloads embedded in vulnerable parameters. The affected parameters include:

BOOT_SERVER, BOOT_FILE, BOOT_ROOT
START_ADDR, END_ADDR
DNS1, DNS2, NTP1, NTP2
WINS1, WINS2
DEFAULT_LEASE_TIME, MAX_LEASE_TIME
DOMAIN_NAME, NIS_DOMAIN, NIS1, NIS2
STATIC_HOST, STATIC_DESC, STATIC_MAC, STATIC_IP

An attacker would typically craft a malicious page or link that, when visited by an authenticated Smoothwall administrator, submits a POST request containing XSS payloads to the vulnerable CGI script. The injected JavaScript then executes in the administrator's browser session.

Technical details and proof-of-concept information can be found in the Exploit-DB #46333 advisory and the VulnCheck Advisory for Smoothwall.

Detection Methods for CVE-2019-25380

Indicators of Compromise

Unusual POST requests to /cgi-bin/dhcp.cgi containing script tags or JavaScript event handlers
Web server access logs showing URL-encoded payloads in DHCP configuration parameters
Unexpected JavaScript execution or browser alerts when accessing DHCP configuration pages
Session tokens being transmitted to external domains

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in requests to CGI scripts
Monitor HTTP request logs for suspicious payloads containing <script>, javascript:, or event handlers like onerror, onload
Deploy browser-based XSS protection and Content Security Policy (CSP) headers
Review access logs for unusual activity patterns on administrative interfaces

Monitoring Recommendations

Enable detailed logging for all requests to the Smoothwall web management interface
Configure SIEM alerts for XSS attack signatures in web traffic destined for firewall management ports
Monitor for unauthorized administrative actions that may indicate successful session hijacking
Implement network segmentation to limit exposure of management interfaces

How to Mitigate CVE-2019-25380

Immediate Actions Required

Restrict access to the Smoothwall web management interface to trusted networks only
Implement IP-based access controls to limit who can reach administrative CGI scripts
Consider placing the management interface behind a VPN or bastion host
Educate administrators about phishing attacks and the risks of clicking untrusted links while logged into administrative interfaces

Patch Information

Administrators should check the Smoothwall Official Website for available security updates or newer versions that address this vulnerability. If no patch is available, implement the workarounds described below to reduce exposure.

Workarounds

Restrict management interface access to localhost or a dedicated management VLAN
Use a reverse proxy with XSS filtering capabilities in front of the Smoothwall management interface
Implement browser-based protections such as Content Security Policy headers if possible through a reverse proxy
Consider using alternative firewall solutions if Smoothwall Express is no longer maintained

bash

# Example: Restrict management interface access via iptables
# Allow management access only from trusted admin workstation
iptables -A INPUT -p tcp --dport 81 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 81 -j DROP
iptables -A INPUT -p tcp --dport 441 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 441 -j DROP