The Endian Firewall component /cgi-bin/zonefw.cgi contains a stored cross‑site scripting flaw that is triggered by supplying malicious content in the remark parameter. An attacker who authenticates with sufficient privileges can inject arbitrary JavaScript; the script is persisted and executed in the browsers of any user who later views the affected page. This weakness is classified as CWE‑79.

Endian Firewall releases 2.1.2, all 2.4 sub‑releases, and 3.3.25 are affected. Users of these versions are susceptible to the remark‑parameter XSS vulnerability.

The CVSS base score of 5.1 indicates moderate severity. Exploitation requires authenticated administrative access, limiting the attacker to users with such privileges. The EPSS metric is not available, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that widespread exploitation is currently unlikely. Because the vulnerability is stored, any user who accesses the affected page after the injection will have the malicious script executed in their browser.