CVE Catalog
CVE-2026-34823
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript.
Risk Assessment
Malicious script may execute in other administrators' browsers, potentially leading to session theft or unauthorized actions.
Recommendation
Update Endian Firewall to a version later than 3.3.25 or implement proper input filtering.
Original NVD description (English source)
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.