The vulnerability allows an authenticated attacker to inject arbitrary JavaScript via the remark user ham spam parameter to /cgi-bin/salearn.cgi. The injected script is stored and later executed in the browsers of other authenticated users who view the page. This stored cross‑site scripting can lead to session hijacking, defacement, data exfiltration, or phishing attacks within the affected system.

This issue affects Endian Firewall versions 3.3.25 and all earlier releases, including 2.1.2 and 2.4. The flaw resides in the web‑based management interface exposed by the /cgi-bin/salearn.cgi endpoint.

The CVSS score of 5.1 indicates moderate severity; the vulnerability is not listed in CISA’s KEV catalog and EPSS data is not available. Because the attack requires authentication to the management interface, the threat surface is limited to authorized users, but once the malicious script runs it can compromise the user’s session and any sensitive data accessed through the interface. The susceptibility is significant enough to warrant timely remediation.