The vulnerability exists in Endian Firewall when processing the remark parameter of the vpnfw.cgi script. An authenticated user can inject arbitrary JavaScript that the system stores and later renders on pages viewed by other users. This stored cross‑site scripting can allow attackers to steal session cookies, deface content, or execute malicious code within the victim’s browser context.

Affected by this flaw are Endian Firewall 3.3.25 and all earlier releases of the Enterprise line as well as versions 2.1.2, 2.4, and the community edition. Users running any of these versions without a vendor‑issued fix are vulnerable.

The CVSS score of 5.1 indicates medium severity. The EPSS rate of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not in the CISA KEV catalog. Nevertheless, because the attack requires authentication and originates from privileged users, the risk remains non‑zero. An exploit would involve logging in with permission to modify remarks, submitting a payload, and waiting for another user to load the page that displays the stored remark.