CVE-2026-34810 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter of the /cgi-bin/vpnfw.cgi endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code, which is then stored and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no information about an available patch or vendor advisory specifying remediation.

Successful exploitation allows an authenticated attacker to inject and store malicious JavaScript code that executes in the browsers of other users viewing the affected page. This can lead to client-side attacks such as session hijacking or unauthorized actions performed in the context of the victim user. The vulnerability requires authentication and user interaction (viewing the affected page) to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and consider applying web application firewall rules to detect and block suspicious input in the remark parameter. Educate users to be cautious when interacting with the affected interface. Monitor vendor channels for updates regarding patches or official mitigations.