CVE-2026-34817

MediumCVSS 6.4

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the ADDRESS BCC parameter in /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Risk Assessment

An attacker can steal sessions, data, or redirect users to malicious sites, compromising system confidentiality and integrity.

Recommendation

Update Endian Firewall to the latest version that fixes this vulnerability and restrict access to the admin panel.

Original NVD description (English source)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.