CVE-2026-34804 is a stored cross-site scripting vulnerability in Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the dscp parameter on the /manage/qos/rules/ endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored persistently and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 4.0 score of 5.1, indicating medium severity. There is no information about an available patch or vendor advisory confirming remediation.

An authenticated attacker can exploit this vulnerability to inject and store malicious JavaScript code that executes in the browsers of other users who access the affected page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other client-side attacks. The impact is limited to authenticated attackers and users who visit the vulnerable page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing additional input validation or output encoding as a temporary mitigation. Monitor vendor communications for updates on patches or official fixes.