The vulnerability allows an authenticated user to submit arbitrary JavaScript through the user parameter of /cgi-bin/proxyuser.cgi. Because the input is stored and later rendered without proper sanitization, the script executes in the browsers of any other visitor to the page, enabling session hijacking, defacement, or hidden redirects. This stored XSS weakness is classified under CWE‑79.

Endian Firewall products are affected, including versions 2.1.2, all 2.4 releases, version 3.3.25, and the community edition. Any deployment that has not been upgraded to a version where the flaw is fixed remains vulnerable.

The flaw carries a CVSS score of 5.1, indicating medium severity, and an EPSS score below 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA known exploited vulnerabilities catalog. Exploitation requires authenticated credentials, limiting the attack surface to privileged users or compromised accounts. Nonetheless, because the injected script runs in clients' browsers, the potential for credential theft, session hijacking, and other client‑side abuse warrants prompt remediation.