Endian Firewall versions up to 3.3.25 contain a stored cross‑site scripting flaw in the /manage/qos/classes/ name parameter. An authenticated attacker can submit arbitrary JavaScript that is saved to the database and later runs in the browser of any user who views the page, effectively executing code with the victim’s privileges within the web interface.

Endian Firewall releases 2.1.2, 2.4, and 3.3.25 are affected. These versions expose the /manage/qos/classes/ endpoint for which the name field is not properly validated or encoded.

The CVSS score of 5.1 indicates moderate severity. Because an attacker must first authenticate, the attack vector is limited to users with legitimate credentials. Exploitation requires access to the management interface; the vulnerability is not listed in the CISA KEV catalog, and an EPSS score is not available, suggesting limited public exploitation. Affected users will see the injected script execute whenever they load the QoS classes page, granting the attacker the same permissions as the viewing user.