This vulnerability allows an authenticated user on an Endian Firewall appliance to store and execute arbitrary JavaScript through the remark field of /cgi-bin/xtaccess.cgi. The injected script is persisted and runs automatically when other users view the impacted page, exposing them to potential script‑based attacks.

Endian Firewall 2.1.2, 2.4, 3.3.25 and community editions before those releases are vulnerable. No newer releases have been confirmed to contain the flaw.

The flaw scores 5.1 on the CVSS scale and has an EPSS percentage lower than one percent, indicating a low likelihood of widespread exploitation. It does not appear on the CISA KEV list. The attacker must authenticate to the administrative interface but does not need higher privileges beyond that to insert the malicious remark. Because the malicious content is stored, any subsequent user who retrieves the remark will have the script executed in their browser.