CVE-2026-34798

MediumCVSS 6.4

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Risk Assessment

An attacker can hijack sessions of other administrators, steal data, or perform unauthorized actions in the firewall management panel.

Recommendation

Update Endian Firewall to the latest version that fixes this vulnerability. Restrict access to the admin panel to trusted users only.

Original NVD description (English source)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.