A stored cross‑site scripting flaw allows an authenticated user to inject arbitrary JavaScript into the remark field on the /manage/dhcp/fixed_leases/ page. The injected script is then persisted and executed in the browsers of any user who views the page, potentially enabling session hijacking, credential theft, or defacement. The weakness is the classic stored XSS defect identified as CWE‑79.

Endian Firewall appliances running version 3.3.25 and earlier, as well as certain 2.1.2 and 2.4 releases, are susceptible to this vulnerability. The affected software releases are explicitly listed in Endian’s documentation and the corresponding CPE entries.

The CVSS score of 5.1 indicates moderate severity. Because the flaw requires authentication, exploitation is likely limited to attackers that can log into the administrative interface or have compromised legitimate administrative credentials, which may be local or remote depending on network configuration. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, so while a known exploit is not documented, the potential exists. Administrators should treat this as a moderate to high risk if privileged accounts are not tightly controlled.