The vulnerability permits an authenticated user to inject malicious JavaScript into the REMARK field of the OpenVPN client configuration page. The input is stored in the database and later rendered in the browser, so any user who views the configuration will have the injected script executed in their context, enabling session hijacking, credential theft, or phishing attacks. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

Endian Firewall installations using versions 2.1.2, 2.4, or 3.3.25 are impacted. The flaw exists in all releases up to and including those listed by the Common Platform Enumeration strings in this advisory.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the administrative interface; the attacker must first log in before injecting the REMARK payload. Once a malicious remark is stored, any subsequent users who load the OpenVPN client page will have the injected script executed in their browsers. The likely attack vector is via the web‑based administrative interface, and the requirement for login credentials makes the threat more suitable for privileged insiders or compromised accounts.