CVE-2026-34819

MediumCVSS 6.4

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the REMARK parameter in /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Risk Assessment

An attacker could steal sessions of other administrators, modify firewall configuration, or access sensitive data.

Recommendation

Update Endian Firewall to the latest version that fixes this vulnerability. Restrict access to the admin panel to trusted IP addresses only.

Original NVD description (English source)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.