CVE-2026-34812

MediumCVSS 6.4

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the mimetypes parameter in /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Risk Assessment

An attacker can steal sessions, data, or redirect users to malicious sites, compromising system confidentiality and integrity.

Recommendation

Update Endian Firewall to the latest version that fixes this vulnerability and restrict access to the admin panel.

Original NVD description (English source)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.