The vulnerability allows an attacker with authenticated access to inject arbitrary JavaScript into the remark field of the /manage/dnsmasq/hosts/ page. The input is stored and executed whenever another authenticated user views the page, enabling client‑side code execution that can lead to session hijacking, credential theft, or defacement. The weakness corresponds to a classic stored XSS scenario.

Ingress systems affected are Endian Firewall versions 2.1.2, 2.4, 3.3.25, and the community edition, all of which store user remarks in the /manage/dnsmasq/hosts/ component. Any installation that has not been upgraded beyond these releases remains vulnerable.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and a user with permission to edit the remark field, after which the malicious script is persisted and executed for other users.