CVE-2026-34806 is a stored cross-site scripting vulnerability in Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter of the /cgi-bin/snat.cgi endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored on the server and executed in the context of other users who access the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 5.1, indicating medium severity.

The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page, which can lead to theft of session tokens, user impersonation, or other client-side impacts. Since the attacker must be authenticated, the risk is limited to users with some level of access to the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider monitoring for suspicious activity related to the remark parameter. Avoid using the affected version in production environments if possible.