The vulnerability permits authenticated users to inject arbitrary JavaScript through the remark parameter of /cgi-bin/snat.cgi. The input is saved and rendered to other users without proper sanitization, allowing the attacker to execute malicious code in the victim’s browser. This can lead to defacement of the web interface or the exfiltration of session data.

Endian Firewall releases 2.1.2, 2.4, 3.3.25, and the community edition contain the flaw within the snat.cgi function.

With a CVSS score of 5.1, the issue is classified as medium severity, while an EPSS score below 1% indicates a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Because only authenticated administrators can trigger the vulnerability, the threat is limited to users with such privileges, yet a compromised admin account can affect all other users who view the page. The attack is client‑side only; there is no server‑side arbitrary code execution.