An authenticated user can supply arbitrary JavaScript to the remark field that is stored and later executed whenever other users view the affected page. This stored cross‑site scripting flaw, characterized by CWE‑79, allows the attacker to inject client‑side code that can manipulate the web interface, deface content, or harvest session cookies and other sensitive data from other users’ browsers.

The vulnerability affects Endian Firewall software. Versions 3.3.25 and all earlier releases—including cpe:2.3:a:endian:firewall:2.1.2, cpe:2.3:a:endian:firewall:2.4, cpe:2.3:a:endian:firewall:3.3.25, and the community build cpe:2.3:a:endian:firewall_community—are susceptible. Administrators should verify whether their deployment is running any of these affected releases.

With a CVSS score of 5.1 the flaw presents moderate severity. The EPSS score indicates a probability of exploitation below 1%, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated session on the web interface; once authenticated, an attacker can store malicious JavaScript and affect all other users who view the zone firewall page.