The vulnerability is caused by insufficient sanitization of the group parameter in the /cgi-bin/proxygroup.cgi endpoint of Endian Firewall. An attacker who has authenticated access can inject arbitrary JavaScript that is stored and subsequently executed whenever other users view the affected page, resulting in a stored cross‑site scripting flaw.

Endian Firewall versions 2.1.2, 2.4, and 3.3.25, as well as earlier releases that correspond to the listed CPE strings, are affected by this issue.

With a CVSS score of 5.1, the flaw is classified as medium severity. The description specifies that only authenticated users can exploit the vulnerability, implying an internal or privileged threat model. No publicly disclosed exploit is indicated, and the vulnerability is not listed in the CISA KEV catalog. The lack of an EPSS score means that exploit probability is not quantified, but the deficient input handling provides a potential attack path for authenticated insiders.