This vulnerability allows a user with legitimate credentials to embed malicious JavaScript in the remark field of the /manage/ipsec/ page. Once stored, the script runs whenever the target page is viewed by other authenticated users, compromising the confidentiality and integrity of user sessions. The weakness is a classic stored XSS flaw categorized as CWE‑79.

The flaw affects Endian Firewall releases up to and including version 3.3.25. Versions 2.1.2, 2.4, and the community build are also listed as vulnerable in the vendor’s CPE data. Users operating any of these firmware branches are potentially exposed.

The CVSS score of 5.1 indicates a moderate impact, while the EPSS score of less than 1% suggests current exploitation likelihood is low. The vulnerability is not listed in the KEV catalog, implying no known active exploitation. The attack vector requires authentication, meaning an attacker must first gain legitimate access—either through credential compromise or insider threat—to inject the malicious script.