Authenticated users can submit a specially crafted value for the new_cert_name parameter on the "/manage/ca/certificate/" page. The input is stored and later rendered in other users’ browsers, allowing the attacker to inject arbitrary JavaScript. This client‑side code execution can be used to hijack sessions, steal credentials or perform other malicious actions in the context of victims’ browsers.

The flaw affects Endian Firewall versions 3.3.25 and all earlier releases, including the community edition. The insecure behavior is present in the 2.1.2, 2.4, 3.3.25, and community builds referenced by the product’s CPE identifiers.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with sufficient privileges to submit data via the web interface, after which the injected script is delivered to other users who view the certificate page. Because it relies on a web application input and internal user privileges, the attack vector is inferred to be authenticated through the web UI rather than remote unauthenticated access.