Stored cross‑site scripting is possible via the new_cert_name parameter in the /manage/ca/certificate/ page of Endian Firewall. An attacker who is authenticated to the firewall can submit malicious JavaScript that is saved by the system and later executed in any visitor’s browser that accesses the page. This can lead to theft of session cookies, navigation to malicious sites, or execution of additional scripts without user knowledge.

Endpoint devices running Endian Firewall version 3.3.25 or earlier are affected, including releases 2.1.2, 2.4, and 3.3.25. The vulnerability exists in the web interface that allows creation of new certificates through the new_cert_name field. Any installation that has not been updated beyond these versions is at risk.

The CVSS score of 5.1 indicates a moderate severity. Although the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the flaw requires only an authenticated user session and can be exploited by anyone with access to the certificate management page. Successful exploitation could compromise the confidentiality and integrity of the web session for other users, and perform actions such as session hijacking or content injection.