The flaw is a stored cross‑site scripting vulnerability in Endian Firewall’s /manage/ipsec/ page. By supplying a malicious remark value, an authenticated user can insert arbitrary JavaScript. When other users view the remark, the script runs in their browsers, allowing the attacker to steal session data, manipulate the page, or execute additional malicious actions.

Endian Firewall versions 2.1.2, 2.4, and 3.3.25 – and all earlier releases up to 3.3.25 – are affected. These include the product families listed by Endian and the respective combinations of minor and patch versions noted in the CNA data.

With a CVSS score of 5.1 the vulnerability is of moderate severity. Exploitation requires attacker authentication to the firewall, but once a malicious remark is stored it executes for any user who views the affected page. EPSS data is not available and the issue is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed. Nonetheless, within an organization the risk remains significant because any privileged or logged‑in user could trigger the payload.