CVE-2026-34800 is a stored cross-site scripting vulnerability in Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the NAME parameter of the /cgi-bin/uplinkeditor.cgi endpoint. An attacker with authentication privileges can inject malicious JavaScript code that is persistently stored and executed in the context of other users viewing the affected page. This vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page. This could lead to session hijacking, unauthorized actions performed on behalf of users, or other client-side attacks. However, the attacker must have authentication access to the system, which limits the scope of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and consider applying web application firewall rules to detect and block suspicious input patterns targeting the NAME parameter. Monitor for updates from Endian regarding patches or official mitigations.