The vulnerability permits an authenticated attacker to inject arbitrary JavaScript through the DOMAIN parameter in /cgi-bin/smtpdomains.cgi. The injected code is stored on the system and executed when other users view the affected page, enabling client‑side code execution. Based on the description, it is inferred that this could allow an attacker to steal session data, hijack credentials, or launch further web‑based attacks against users of the firewall interface.

Endian Firewall installations running version 3.3.25 or earlier, as well as builds based on the 2.4 series and the 2.1.2 series, are affected. The flaw exists in the web interface that handles SMTP domain configuration and is present across all releases matching the provided CPE identifiers.

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user to submit a crafted DOMAIN value via the web UI. Once injected, the script runs for all users who access the page, creating a risk to confidentiality and potentially to the integrity of configuration data. The absence of exploit probability data means the threat level must be judged based on the vulnerability’s nature and the environment’s exposure.