Endian Firewall versions 3.3.25 and earlier allow a stored cross‑site scripting vulnerability through the domain parameter in the /manage/smtpscan/domainrouting/ page. A malicious user can embed arbitrary JavaScript that is saved to the system and executed whenever any authorized user views the page. The attack grants the attacker the privilege of running arbitrary code in the context of the victim user, enabling session hijacking, data exfiltration or defacement.

Affected products are Endian Firewall releases up to and including version 3.3.25, including the 2.x line (2.1.2 and later) and the 3.x line up to 3.3.25. All installations that expose the /manage/smtpscan/domainrouting/ endpoint and allow authenticated users to modify the domain parameter are vulnerable.

The CVSS base score of 5.1 indicates moderate severity. Exploitation requires authenticated access with permission to modify the domain setting, so privileged accounts are the attack surface. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is internal and relies on compromise or misuse of legitimate credentials, the likelihood depends on the frequency of privileged account breaches. The resulting risk is therefore moderate, with significant potential for user impact if the vulnerability is abused.