CVE-2026-34809 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the handling of the remark parameter in the /cgi-bin/zonefw.cgi endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code. This code is stored persistently and executed in the context of other users who access the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability requires authentication and user interaction to trigger the malicious script execution.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users viewing the affected page. This can lead to theft of session tokens, unauthorized actions performed on behalf of users, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability does not allow unauthenticated access or direct system compromise based on the provided data.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected functionality to trusted users only and consider applying input validation or output encoding workarounds if feasible.