This flaw allows a logged‑in user to save malicious JavaScript in the remark field used by /cgi‑bin/incoming.cgi. When other users visit the same page, the script runs in their browsers. Because the payload is stored on the server, the attack propagates to every user who views the affected content, potentially exposing session cookies, defacing the interface, or executing further malicious actions. The weakness is a classic input validation error classified as CWE‑79.

The weakness exists in Endian Firewall versions 2.1.2, 2.4, 3.3.25 and all earlier releases. Administrators using any of these builds should treat the environment as vulnerable until a patch is applied.

CVSS score 5.1 indicates moderate severity; EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited through the web interface by an authenticated user who submits a remark containing a script tag. The stored nature of the payload means that any subsequent user viewing the page will have the malicious code executed in their browser, allowing session hijacking, defacement, or further injection attacks. The risk is therefore moderate but potentially widespread among users of the affected system.