Endian Firewall versions prior to 3.3.26 are vulnerable to a stored cross‑site scripting flaw that allows an authenticated attacker to inject arbitrary JavaScript into the mimetypes parameter of /cgi-bin/proxypolicy.cgi. The script is saved and executed whenever another user accesses the affected configuration page, potentially enabling session hijacking, data theft or defacement. The weakness is a classic stored XSS (CWE‑79).

The vulnerability affects Endian Firewall 2.1.2, all releases of the 2.x series and the 2.4 branch, as well as version 3.3.25 and earlier releases of the 3.3.x line. Users running any of these versions without the vendor‑supplied update are at risk.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalogue. Exploitation requires legitimate administrative credentials; once logged in, an attacker can manipulate the mimetypes field and persist malicious code that will run in the browsers of other privileged users. The requirement for authentic access limits the attack surface, but the impact on confidentiality, integrity and availability of administrative sessions justifies prompt remediation.