CVE Catalog
CVE-2026-34801
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk0.21%
11th percentile - higher than 11% of all known CVEs
Summary
In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /manage/dhcp/fixed_leases/. An authenticated attacker can inject JavaScript that executes when other users view the page.
Risk Assessment
The risk involves potential session theft, redirects to malicious sites, or administrator data theft.
Recommendation
It is recommended to upgrade to a newer version of Endian Firewall that contains the fix.
Original NVD description (English source)
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.