CVE-2026-34821
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that executes when other users view the page.
Risk Assessment
An attacker could hijack admin sessions, steal data, or perform unauthorized actions in the firewall management interface.
Recommendation
Update Endian Firewall to the latest patched version. Restrict access to the admin panel to trusted users only.
Original NVD description (English source)
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.