An authenticated user can enter malicious JavaScript into the remark field on the /manage/vpnauthentication/user/ page. The stored JavaScript is rendered to any user who views that page, allowing the attacker’s code to run in the victim’s browser. The flaw is a classic stored XSS vulnerability, identified in CWE‑79. The consequence is that the attacker can run client‑side scripts in other users’ browsers, potentially manipulating the session or executing unauthorized actions.

The issue exists in multiple Endian Firewall releases, including version 2.1.2, 2.4, and 3.3.25, as well as the community edition. All listed releases store the remark field content unfiltered and replay it to clients.

The vulnerability has a CVSS score of 5.1, indicating moderate severity, and an EPSS score below 1 %, suggesting a low probability of active exploitation. Because authentication is required, only users with management privileges can inject payloads. The flaw is not present in the CISA KEV catalog.