The vulnerability allows an attacker with authentication to inject arbitrary JavaScript into the remark field of the /manage/dnsmasq/hosts/ page. The payload is stored and re‑exposed to all users viewing that page, enabling clients to execute malicious code within their browsers. Potential consequences include session hijacking, credential theft, and defacement of the management console.

Endian Firewall products, specifically versions 2.1.2, 2.4, and 3.3.25, are affected. The flaw resides in the handling of the remark parameter used in the dnsmasq hosts configuration interface.

With a CVSS score of 5.1 the vulnerability is considered moderate severity. The exploit requires an authenticated session, and no public zero‑day charges have been reported, reducing the likelihood of widespread exploitation. However, once legitimate access is obtained or credentials are compromised, the stored XSS can be leveraged against all other users with visibility of the page. The advisory indicates the flaw is not listed in the KEV catalog and EPSS data is not available, suggesting it is a relatively low‑profile risk to external actors but a significant internal threat if credentials are abused.