The vulnerability is a stored cross‑site scripting flaw in the ADDRESS BCC field of /cgi-bin/smtprouting.cgi. An attacker with valid credentials can embed JavaScript that is saved in the system. When other users load the page, the script runs in their browsers, exposing them to session hijacking, credential theft, or malicious redirects. This aligns with CWE‑79.

Endian Firewall versions 3.3.25 and earlier, including 2.1.2, 2.4, 3.3.25, and the community edition, are affected. The flaw exists in the firewalls running those builds.

The CVSS base score of 5.1 indicates moderate severity. The EPSS score is below 1 %, showing low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires having authenticated access to the firewall administration interface; once logged in, an attacker can inject the payload through the ADDRESS BCC field of the SMTP routing configuration. The attacker’s impact is limited to browsers of users who view the modified page.