Endian Firewall version 3.3.25 and earlier allow an attacker who is authenticated to insert JavaScript into the remark field of /cgi-bin/routing.cgi. The script is stored and later executed automatically when other users view the affected page, resulting in the injection of user‑supplied code into the web interface.

The vulnerability affects Endian Firewall products for Endian, specifically versions 2.1.2, 2.4, 3.3.25 and any earlier releases. Administrators using any of these builds are exposed to the flaw.

The base score of 5.1 on the CVSS scale represents moderate severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Because the attacker must be authenticated, the initial attack surface is limited to users with permission to modify routing remarks, but once data is stored, any user navigating the replaced page will execute the injected script.