Endian Firewall versions 3.3.25 and earlier contain a stored cross‑site scripting flaw in the remark field of the /manage/vpnauthentication/user/ endpoint. The flaw permits an attacker who has authenticated to the firewall to submit malicious JavaScript that is stored by the server and automatically executed when any user views the affected page. Execution of this payload in the victim’s browser can enable session hijacking, data theft, or defacement, compromising the confidentiality and integrity of the user session data.

Endian Firewall is affected with all versions listed in the CVE, including 2.1.2, 2.4, and 3.3.25. Any deployment of those firmware releases is vulnerable until a patch is applied.

The flaw scores a CVSS base of 5.1, indicating a moderate severity, and is not yet listed in CISA’s KEV catalog. An attacker must first authenticate to the system, which limits the exposure to users with administrative privileges or compromised credentials. Without an authenticated session, the vulnerability cannot be triggered.