CVE-2026-34803 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall versions up to 3.3.25. The vulnerability arises from improper neutralization of input in the 'name' parameter on the /manage/qos/classes/ endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored persistently and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page, potentially leading to session hijacking, credential theft, or other malicious actions within the context of the Endian Firewall management interface. The impact is limited to authenticated users and requires user interaction to trigger the payload execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected management interface to trusted users only and consider monitoring for suspicious activity related to the injection point. Avoid using the vulnerable parameter with untrusted input.