The flaw allows an authenticated attacker to store arbitrary JavaScript in the remark field of /cgi‑bin/outgoingfw.cgi. When other users view the page, the script executes on their browsers, enabling client‑side code execution. This stored XSS threatens the confidentiality and integrity of users who access that page.

Affected appliances include Endian Firewall versions 2.1.2, 2.4, 3.3.25, and the Community edition. All releases up to and including 3.3.25 store the remark input without proper sanitization and are vulnerable.

The CVSS score of 5.1 places the issue in the moderate range. An EPSS score below 1 % indicates a low likelihood of public exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated account with permissions to modify outgoing firewall rules. Once a malicious remark is stored, any user who accesses that remark will execute the injected code. The attack, therefore, is limited to organizations that have multiple privileged users and does not involve an unauthenticated remote vector.