CVE-2026-34808 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the handling of the remark parameter in the /cgi-bin/outgoingfw.cgi endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code. This code is stored on the server and executed in the context of other users who access the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability requires authentication and user interaction to trigger the malicious script execution.

An authenticated attacker can exploit this vulnerability to inject and store malicious JavaScript code that executes in the browsers of other users viewing the affected page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other client-side impacts typical of stored XSS vulnerabilities. The CVSS score of 5.1 reflects a medium severity risk, indicating moderate impact with relatively low complexity to exploit given authentication is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected endpoint to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious input in the remark parameter. Monitor for unusual activity from authenticated users. Avoid clicking on suspicious links or interacting with untrusted content within the affected application.