CVE-2026-34822
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Endian Firewall version 3.3.25 and prior have a stored cross-site scripting (XSS) vulnerability via the new_cert_name parameter in /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.
Risk Assessment
The organization is at risk of session theft, account takeover of other administrators, or unauthorized actions in the firewall management panel.
Recommendation
Update Endian Firewall to a version later than 3.3.25 that fixes the XSS vulnerability.
Original NVD description (English source)
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.