The vulnerability arises from the dscp parameter in the /manage/qos/rules/ page, where user input is stored without proper validation. An attacker with administrative credentials can inject JavaScript that is later executed in the browsers of other users who view that page. This stored cross‑site scripting can lead to session hijacking, credential theft, or page defacement. The underlying weakness is reflected input leading to XSS, identified as CWE‑79.

Endian Firewall versions 3.3.25 and earlier, including releases 2.1.2, 2.4, and the community edition, are affected. The issue is present in all builds that include the /manage/qos/rules/ endpoint with the dscp parameter unfiltered.

The CVSS score of 5.1 indicates moderate risk. EPSS below 1% suggests a very low likelihood of current exploitation. The vulnerability is not listed in the KEV catalog. Exploitation requires authentication to the management interface, so the attack vector is limited to users who can log in. Once authenticated, an attacker can persist malicious script that runs on other users’ browsers when they access the same page, enabling client‑side compromise.