Smoothwall Express 3.1 is vulnerable to multiple cross-site scripting flaws that could allow attackers to execute arbitrary scripts in the browsers of administrative users.

The application fails to properly neutralize user-supplied input within multiple CGI scripts, including preferences.cgi, proxy.cgi, and dhcp.cgi. These flaws allow unauthenticated or authenticated attackers to perform stored or reflected XSS attacks by injecting malicious payloads into specific POST parameters.

Successful exploitation of these XSS vulnerabilities could lead to session hijacking, unauthorized administrative actions, or the redirection of users to malicious content. Given the product is a firewall management interface, the compromise of an administrator session presents a severe risk to the entire network security posture. The CVSS score of 7.2 reflects the high potential for impact on confidentiality and integrity within the management environment.

Immediate Action: Since a direct patch is currently unknown, administrators should restrict access to the web management interface to trusted management subnets only. Disabling the affected CGI features if they are not required for core operations is advised.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at cgi-bin scripts, specifically looking for script tags or encoded characters in parameters like HOSTNAME, KEYMAP, or OPENNESS.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to inspect and block malicious payloads targeting these CGI endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit Database (EDB-ID: 46333).

The presence of multiple XSS vectors in a security-focused product like Smoothwall Express represents a significant risk to administrative infrastructure. Administrators must treat this vulnerability with high urgency by restricting network access to the management interface and employing WAF rules to filter malicious traffic until a vendor-supplied patch is identified and applied.