EUVD-2026-18328
GHSA-c555-qwvr-3579
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
AnalysisAI
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary JavaScript via the remark parameter in the /manage/password/web/ endpoint. The injected payload is persistently stored and executes when other authenticated users access the affected page, enabling session hijacking, credential theft, or lateral movement within the firewall management interface. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability is a classic stored XSS flaw (CWE-79) arising from insufficient input validation and output encoding on the remark parameter in Endian Firewall's web management interface. The /manage/password/web/ endpoint fails to properly sanitize user-supplied input before storing it in a backend database, and subsequently fails to encode the stored data when rendering it in HTML responses. This allows an authenticated administrator or lower-privileged user to craft a payload containing JavaScript that persists across sessions and executes in the browser context of any user who views the affected page, bypassing same-origin policy protections through the trust relationship established by prior authentication. The vulnerability affects Endian Firewall Community Edition version 3.3.25 and all prior releases.
RemediationAI
Upgrade Endian Firewall to a version released after 3.3.25 that includes XSS input validation and output encoding fixes. Organizations unable to upgrade immediately should implement the following mitigations: restrict access to the /manage/password/web/ endpoint via network ACLs or firewall rules to trusted administrative networks only; disable web management access if not actively required; ensure strong authentication controls and multi-factor authentication are enforced for administrative accounts; and regularly audit stored remarks and password change logs for suspicious content or unauthorized modifications. Contact Endian support at https://help.endian.com/hc/en-us/sections/360004371358-Community for patched version availability and deployment guidance. No patch version has been independently confirmed at time of analysis; verify vendor advisory for exact fixed version numbers before deployment.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbi
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS co
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through t
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today