Smoothwall Express versions before 3.1 Update 13 store user‑supplied data in the VPN_IP parameter of the vpnmain.cgi script without proper sanitization. An authenticated attacker who can modify VPN configuration settings can inject arbitrary JavaScript. When the affected page is later viewed by other users, the injected script runs in their browsers, allowing the attacker to steal session cookies, deface the interface, or execute further malicious actions. This vulnerability falls under CWE‑79, a Cross‑Site Scripting weakness.

The affected product is Smoothwall Express. All releases earlier than version 3.1 Update 13 (i.e., 3.1 Update 12 and earlier) are vulnerable. No newer major releases are listed.

The CVSS v3.1 score is 5.1, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires legitimate administrative access to modify VPN settings, after which the malicious script can be served to other users who view the VPN page. While the window for exploitation is limited to user sessions that load the vulnerable page, any successful abuse could compromise the confidentiality of credentials and potentially allow further lateral movement if attackers can create additional scripts.