A direct injection flaw exists in the dscp parameter of the /manage/qos/rules/ endpoint, allowing an authenticated attacker to store malicious JavaScript code. When other users view the affected page, the script is executed in their browsers, enabling the attacker to perform actions such as session hijacking, data theft, or web‑page defacement. The vulnerability is a classic example of stored XSS, classified as CWE‑79.

The flaw affects Endian Firewall products, specifically versions 3.3.25 and all older releases, including 2.4 and 2.1.2. Any installation that exposes the /manage/qos/rules/ interface to authenticated users is vulnerable.

The standard CVSS score of 5.1 indicates a medium risk rating, and the vulnerability is not currently listed in the CISA KEV catalog. Because exploitation requires authentication, the attack vector is limited to accounts with management privileges. Once a payload is stored, it automatically runs for any subsequent viewer of the page, increasing the potential impact for users with access to the management interface. No publicly available exploit exploits have been documented; however, the lack of input validation presents a clear opportunity for malicious code injection if an attacker gains legitimate access.