An authenticated attacker can insert arbitrary JavaScript into the ADDRESS BCC field of the smtprouting.cgi script. The content is stored and later executed whenever any user loads the affected page, resulting in a stored cross‑site scripting vulnerability. Because the script runs in the victim’s browser, the attacker can steal session cookies, deface the user interface, or redirect users to malicious sites. This flaw is classified as CWE‑79.

The weakness affects Endian Firewall releases from version 2.1.2 through 3.3.25 and any earlier builds. All installations that provide the smtprouting.cgi functionality are susceptible, as the issue originates in the processing of the ADDRESS BCC input. Administrators should verify whether they run one of the listed versions and identify any smtprouting configuration entries that contain unsanitized user input.

The CVSS score of 5.1 indicates moderate severity, and the lack of a publicly available EPSS score means the exact exploitation likelihood is unknown. Although the vulnerability is not listed in the CISA KEV catalogue, the fact that it requires authentication and persists in configuration data raises the risk of internal compromise. If an attacker with administrative privileges accesses the system, the stored JavaScript can be triggered for every user that visits the page, potentially enabling widespread credential theft or session hijacking within the organization.