The vulnerability is a stored cross‑site scripting flaw in Endian Firewall’s /cgi‑bin/dnat.cgi. An authenticated attacker can give the remark parameter a malicious JavaScript payload that is stored by the system and executed whenever other users load the affected page. This allows the attacker to run arbitrary scripts in victims’ browsers, giving full access to session data, the ability to deface the interface or redirect users to malicious sites.

The flaw affects Endian Firewall versions 2.1.2, 2.4, 3.3.25 and all community releases prior to 3.3.26. Any installation of these builds that exposes the /cgi‑bin/dnat.cgi endpoint to authorized users is vulnerable. The issue is present in both the commercial and community editions, so administrators should check the build number of their firewall.

The CVSS score of 5.1 indicates a moderate risk, and the low EPSS score (<1%) suggests that widespread exploitation is unlikely at present. However, because the attack requires authenticated access, it can be carried out by insiders or anyone who has compromised an admin account. The vulnerability is not listed in the CISA KEV catalog, so no specific exploit campaigns have been reported. Administrators should consider the risk of an attacker gaining credentials to the management interface and the potential impact of XSS on users’ security.