An authenticated attacker can submit a remark using the user ham spam field in /cgi-bin/salearn.cgi that contains arbitrary JavaScript. The script is stored and executed whenever another user views the page, allowing the attacker to steal credentials, deface the interface, or perform further attacks against users of the same firewall instance.

The flaw exists in Endian Firewall’s various releases, including 2.1.2, 2.4, 3.3.25, and community builds. All versions prior to a vendor‑supplied fix are affected, so any installation of these versions without the latest patch is at risk.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of less than 1% indicates the likelihood of active exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to have authenticated credentials on the firewall; thus it is limited to insiders or compromised accounts. Once authenticated, the attacker can inject arbitrary JavaScript that will run under the privileges of any user who views the affected page.