The flaw allows an authenticated user to embed arbitrary JavaScript into the 'user' field of /cgi-bin/proxyuser.cgi. When other users view the page, the stored script executes in their browsers. Because the script runs with the victim’s credentials, an attacker can hijack sessions, divulge sensitive data or perform actions on behalf of the user, effectively executing code in the user’s context. This stored cross‑site scripting attack corresponds to CWE‑79.

Affected versions of Endian Firewall include releases 2.1.2, 2.4 and 3.3.25 and prior, as indicated by the vulnerable CPEs. These products expose the /cgi-bin/proxyuser.cgi endpoint to authenticated users, allowing the injection described above.

The CVSS score of 5.1 places the vulnerability in the medium severity range. Exploitation requires legitimate authentication and the ability to view the affected page, but no additional privileges are needed. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, because the attacker can run arbitrary code in victims’ browsers, organizations with access to Endian Firewall should treat it as a significant risk, especially in environments with sensitive user sessions.