Endian Firewall up to version 3.3.25 contains a stored cross‑site scripting flaw that is triggered by the remark field on the /manage/password/web/ page. When an attacker with administrative credentials injects malicious JavaScript into this field, the code is preserved on the server and automatically executed in the browsers of any user who later views the page. The vulnerability is identified as CWE‑79 and allows arbitrary script execution with the privileges of the viewing user.

The affected product is Endian Firewall. Versions 2.1.2, 2.4, and 3.3.25 are known to be vulnerable, as are all earlier releases of these versions. Users who operate a build from these iterations should confirm their current version and apply any vendor‑supplied updates.

The CVSS score of 5.1 places this issue in the medium‑severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate exploitation likelihood. Exploitation requires an attacker first to authenticate to the web management interface; once a malicious payload is stored, all subsequent users who load the affected page will automatically execute the script, thereby expanding the impact beyond the initial attacker.