The vulnerability in Endian Firewall allows an authenticated attacker to inject arbitrary JavaScript through the remark field on the /manage/password/web/ page. This content is stored and executed whenever other users view the page, which can lead to client-side attacks. Based on the description, it is inferred that the stored scripts could be used to perform actions such as defacement or exploitation of session data.

Affected systems include Endian Firewall products running version 3.3.25 or earlier, specifically the 2.1.2, 2.4, and community editions. Any installation that exposes the /manage/password/web/ page to authenticated users is vulnerable. The flaw is present in all listed versions and is not limited to a specific build.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers would need authenticated access to the management interface, after which they can store and trigger malicious scripts; the remote web attack surface is mitigated by the authentication requirement, but the impact remains confined to browsers of other authenticated users.