A stored cross-site scripting vulnerability in Comodo Dome Firewall 2.7.0 allows remote attackers to execute arbitrary scripts in the context of an administrator session.

This vulnerability is a stored cross-site scripting flaw (CWE-79) triggered by injecting malicious JavaScript into the newLicense parameter within the license activation endpoint. While the CVSS vector indicates low user interaction, the vulnerability allows an attacker to compromise the sessions of administrative users who interact with the affected interface.

Successful exploitation allows an attacker to execute arbitrary code within the browser of a logged-in administrator. This can lead to the theft of session cookies, unauthorized configuration changes to the firewall, or the redirection of administrative traffic, posing a significant risk to the integrity and confidentiality of network management operations. With a CVSS score of 7.2, this represents a high-severity risk to organizational security infrastructure.

Immediate Action: As no official patch version is documented for this specific legacy issue, organizations should contact the vendor for updated firmware or restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Review web access logs for suspicious POST requests targeting the license activation endpoint or other management paths containing script-like characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to inspect and block malicious payloads directed at the firewall management interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the ExploitDB entry 46408.

Given the availability of public exploit code and the critical nature of firewall management interfaces, organizations currently running Comodo Dome Firewall 2.7.0 must prioritize isolating these devices from external access. If upgrading to a supported version is not possible, implement strict network access control lists to ensure that only authorized administrative workstations can communicate with the management portal.