CVE-2026-34811 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the remark parameter of the /cgi-bin/xtaccess.cgi endpoint, allowing an authenticated user to inject arbitrary JavaScript code. This code is stored on the server and executed in the browsers of other users who access the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability requires low attack complexity, no user interaction beyond authentication, and no privileges beyond authentication. The CVSS 4.0 vector indicates network attack vector, low complexity, no attack or user interaction needed beyond authentication, and low scope and impact on confidentiality, integrity, and availability.

An authenticated attacker can exploit this vulnerability to inject and store malicious JavaScript code that executes in the context of other users viewing the affected page. This can lead to client-side attacks such as session hijacking or unauthorized actions performed by the victim's browser. The impact is limited to authenticated users and the scope is confined to the affected web interface component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected interface to trusted users only and consider implementing input validation or web application firewall rules to detect and block malicious scripts in the remark parameter.