CVE-2026-34807 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter of the /cgi-bin/incoming.cgi endpoint. An attacker with authenticated access can inject arbitrary JavaScript code that is stored on the server and executed in the browsers of users who view the affected page, potentially leading to session hijacking or other malicious actions. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. No patch or official fix information is currently available.

An authenticated attacker can exploit this vulnerability to inject and store malicious JavaScript code that executes in the context of other users' browsers when they access the affected page. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact is limited to users who view the injected content and requires attacker authentication to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to limit the ability to inject malicious input and consider applying web application firewall (WAF) rules to detect and block suspicious input in the remark parameter. Monitor vendor channels for updates on patches or official mitigations.