A stored cross‑site scripting flaw exists in Endian Firewall via the remark parameter of the /cgi‑bin/incoming.cgi endpoint. An authenticated attacker can submit arbitrary JavaScript that is persisted and executed whenever any user views the affected page. The weakness is a classic stored XSS (CWE‑79) that can lead to session hijacking, defacement, or theft of sensitive information if a victim’s browser processes the injected script.

The vulnerability affects Endian Firewall versions 3.3.25 and earlier, including releases 2.1.2, 2.4, 3.3.25, as well as the community edition. No specific sub‑versions are listed beyond the major and minor numbers provided.

The CVSS base score is 5.1, indicating moderate risk, while the EPSS score is reported as below 1%, suggesting low probability of exploitation in the wild. The flaw is not currently cataloged in CISA’s KEV list. Exploitation requires an authenticated user with permissions to submit remarks; the attacker’s malicious payload is then presented to other authenticated or unauthenticated users who access the page, allowing the attacker to execute arbitrary JavaScript in their browsers.