This vulnerability permits a stored cross‑site scripting attack through the domain parameter in the /manage/smtpscan/domainrouting endpoint. An attacker who can authenticate to the system can inject arbitrary JavaScript that is stored in the database and executed each time other users view the affected page, potentially compromising their session cookies, defacing the interface, or exfiltrating data.

The flaw affects Endian Firewall versions 2.1.2, 2.4, 3.3.25, and the community edition. All deployments of these versions are vulnerable until patched.

With a CVSS score of 5.1 the vulnerability presents moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation, and it is not listed in CISA’s KEV catalog. An attacker must have authenticated access to the firewall’s web interface, after which the stored XSS payload is delivered to other users. Because the payload is executed in the context of other users’ browsers, compromises can occur without further network access.