The vulnerability is a stored XSS in the REMARK parameter of /cgi-bin/openvpnclient.cgi in Endian Firewall versions 3.3.25 and earlier. An authenticated user can submit arbitrary JavaScript that is stored in the system and executed when other users view the affected page. The injected code runs in the victim’s browser context.

Affected deployments include Endian Firewall 2.1.2, 2.4, 3.3.25, and community editions. These versions are identified in the provided CPE data.

The CVSS base score of 5.1 indicates moderate severity. EPSS score is below 1%, implying low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must first obtain authenticated access to the system to inject the payload; once stored, the script is delivered to any user who visits the openvpn client page, creating potential for widespread impact within a compromised environment.