CVE-2026-34799 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter on the /manage/dnsmasq/hosts/ page. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored persistently and executed in the context of other users who access the page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires low attack complexity and no user interaction beyond authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low scope impact, and partial integrity and availability impacts.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users viewing the affected page. This can lead to theft of session tokens, unauthorized actions performed on behalf of users, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability does not affect confidentiality or escalate privileges directly but can compromise user sessions and trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider additional input validation or output encoding controls if possible. Monitor vendor communications for updates regarding patches or official mitigations.