CVE-2026-34801 is a stored cross-site scripting (CWE-79) vulnerability in Endian Firewall version 3.3.25 and prior. It arises from improper neutralization of input in the remark parameter on the /manage/dhcp/fixed_leases/ page. An authenticated attacker can inject arbitrary JavaScript code that persists and executes in the context of other users viewing this page, potentially leading to session hijacking or other script-based attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, and partial impact on integrity and availability. No patch or vendor advisory is provided in the data.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page, potentially leading to session hijacking, unauthorized actions, or information disclosure within the context of the Endian Firewall management interface. The impact is limited to authenticated users and requires user interaction to trigger the stored script execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected management interface to trusted users only and consider monitoring for suspicious activity related to the remark parameter. Avoid using the affected functionality if possible. Follow up with Endian for updates on patches or official mitigations.