This vulnerability allows an authenticated attacker to inject malicious JavaScript into the name field of a QoS class on Endian Firewall. Once stored, the script executes whenever other users load the affected management page, potentially hijacking sessions, stealing credentials, or defacing the interface.

The flaw exists in all Endian Firewall releases 2.1.2 through 3.3.25, including the community edition. Users running any of these versions are vulnerable.

The CVSS score of 5.1 reflects a moderate risk, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the KEV catalog. Attackers must first authenticate to the firewall before injecting the payload; thus the vector is authenticated and requires administrative access.