The vulnerability arises from the remark parameter in /cgi-bin/outgoingfw.cgi, which accepts input without proper sanitization. An attacker who is authenticated to the firewall can store malicious JavaScript that is subsequently rendered when other users view the affected page. The stored script is executed in the context of the victim’s browser, allowing the attacker to steal credentials, deface the interface, or perform other malicious client‑side actions. The weakness is reflected in CWE‑79, a stored XSS flaw that can lead to confidentiality and integrity compromise for users who interact with the page.

Endian Firewall products are affected. All releases up to and including version 3.3.25, as well as older 2.4.x and 2.1.2 lines, are vulnerable. The flaw is present in the /cgi-bin/outgoingfw.cgi component of these firmware versions.

The CVSS base score of 5.1 indicates moderate severity, with no exploit probability score available and no listing in the CISA KEV catalog. The likely attack vector is authenticated local access, as the attacker needs valid credentials to submit the remark. Once authenticated, the attacker simply adds a JavaScript payload to the remark field; the script is stored and triggered when other users load the page, making exploitation straightforward for users with administrative privileges on the firewall. Because the affected functionality is part of the web interface, abuse could remain undetected for some time, creating a risk for any administrator who grants write access to the remark field.