Endian Firewall allows an attacker who is already authenticated to embed arbitrary JavaScript into the remark field of the /cgi-bin/vpnfw.cgi endpoint. The inserted script is persisting on the server and is executed whenever any user views that page, leading to potential client‑side attacks such as credential theft, session hijacking, or defacement. This behavior is a classic stored cross‑site scripting flaw, classified as CWE‑79.

The flaw exists in Endian Firewall. Versions 2.1.2, any 2.4 release, and 3.3.25 are affected. The vulnerability is present in the /cgi-bin/vpnfw.cgi component that is delivered by Endian.

The vulnerability has a CVSS score of 5.1, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an authenticated user with write access to the remark field. Although the flaw does not grant direct control of the host, it can enable privileged users to run malicious scripts in other users’ browsers, potentially leading to account compromise or phishing attempts.