Endian Firewall versions up to and including 3.3.25 allow an attacker who possesses valid administrator credentials to insert arbitrary JavaScript into the ``remark`` field of the ``/manage/dnsmasq/localdomains/`` page. The input is persisted and executed whenever any logged‑in user views the page, creating a classic stored XSS defect that can be leveraged to hijack sessions, steal credentials, or deface the interface.

The vulnerability affects Endian Firewall products from version 2.1.2 through 3.3.25, covering both community and paid editions. Any deployment that has not been updated beyond 3.3.25 remains exposed.

The condition rate is medium, reflected by a CVSS score of 5.1. Exploitation requires authenticated access to the management interface, so the likelihood depends on the attacker’s ability to compromise a legitimate account. The vulnerability is not recorded in the known exploited vulnerability list, and EPSS data is unavailable. If compromised, the stored script runs with the privileges of any other logged‑in user, enabling credential theft and other attacks. No public exploit code exists, but the attack path is straightforward: log in, submit a malicious remark, and wait for another user to load the page.