CVE-2026-34813

MediumCVSS 6.4

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

Endian Firewall version 3.3.25 and prior have a stored XSS vulnerability via the user parameter in /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Risk Assessment

The script executes in other users' browsers, potentially leading to session theft or unauthorized actions in the firewall management interface.

Recommendation

Update Endian Firewall to the latest version that includes a fix.

Original NVD description (English source)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.