EUVD-2026-18316Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
AnalysisAI
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary JavaScript via the ADDRESS BCC parameter in /cgi-bin/smtprouting.cgi, with the payload executed when other users view the affected page. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting real-world impact to internal threat actors with valid credentials, though successful exploitation could compromise session integrity and user data within the firewall management interface.
Technical ContextAI
This is a stored (persistent) cross-site scripting vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability exists in the SMTP routing configuration module (/cgi-bin/smtprouting.cgi) of Endian Firewall, a network security appliance. The ADDRESS BCC parameter fails to properly sanitize or encode user-supplied input before storing it in a database or configuration file and subsequently rendering it in HTML responses. When the vulnerable page is accessed by another authenticated user, the injected JavaScript executes in their browser within the context of the firewall management interface, potentially allowing theft of session tokens, admin credentials, or execution of unauthorized administrative actions.
RemediationAI
Upgrade Endian Firewall to a patched version released after 3.3.25. No specific patched version number is provided in the available data; contact Endian support or consult their security advisory for the recommended upgrade path. As a temporary workaround pending patching, restrict access to /cgi-bin/smtprouting.cgi via firewall access control lists (ACLs) to only trusted administrators and implement input validation rules at the network level if the appliance supports custom filtering policies. Refer to the Endian support portal (https://help.endian.com/hc/en-us/sections/360004371358-Community) for vendor guidance on patching timelines and interim mitigations.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbi
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS co
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through t
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today