CVE-2026-34808
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Risk Assessment
An attacker can steal sessions, data, or redirect users to malicious sites, compromising confidentiality and integrity.
Recommendation
Update Endian Firewall to the latest patched version and restrict access to the admin panel.
Original NVD description (English source)
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.