Multiple cross-site scripting vulnerabilities in Smoothwall Express 3.1 enable attackers to execute malicious JavaScript in the browsers of authenticated users, potentially leading to unauthorized actions.

The application fails to properly sanitize user-supplied input across several CGI scripts, including modem.cgi, proxy.cgi, and dhcp.cgi. These flaws allow both stored and reflected cross-site scripting attacks, which can be triggered by submitting malicious payloads through POST parameters.

Successful exploitation of these vulnerabilities allows an attacker to execute arbitrary scripts in the context of an administrator or user session. This can lead to the theft of session cookies, unauthorized changes to firewall configurations, or the redirection of users to malicious sites, severely compromising the integrity and security of the network management interface. With a CVSS score of 7.2, this vulnerability represents a high risk to organizational security.

Immediate Action: As no official patch is currently identified, restrict access to the web management interface to trusted management networks only and implement strict egress filtering.

Proactive Monitoring: Review web access logs for unusual POST requests directed at cgi-bin scripts containing script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block common cross-site scripting payloads targeting the identified vulnerable parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit Database (EDB-ID: 46333).

Given the high severity and the availability of public exploit code, organizations utilizing Smoothwall Express should prioritize the isolation of the management interface from untrusted networks. Administrators must treat the web interface as a high-risk surface and apply any available vendor security updates as soon as they are released to remediate these underlying input validation flaws.