CVE-2026-34798 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter of the /cgi-bin/routing.cgi endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored on the system and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

Successful exploitation allows an authenticated attacker to inject and store malicious JavaScript code, which executes in the browsers of other users who access the affected page. This can lead to client-side attacks such as session hijacking or unauthorized actions performed on behalf of the victim user. The impact is limited to authenticated attackers and users who view the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing additional input validation or output encoding as a temporary mitigation. Monitor vendor communications for updates regarding patches or official mitigations.