CVE-2026-34817 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the handling of the ADDRESS BCC parameter in the /cgi-bin/smtprouting.cgi endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code. This code is stored on the server and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side impacts. The vulnerability requires authentication and user interaction to trigger the malicious script execution.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page. This can lead to theft of session tokens, user impersonation, or other client-side attacks. The vulnerability does not allow unauthenticated remote code execution or direct system compromise. The CVSS 4.0 score of 5.1 reflects a medium severity impact with network attack vector, low complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected interface to trusted users only and apply strict input validation or filtering on the ADDRESS BCC parameter if possible. Monitor for suspicious activity related to authenticated users injecting scripts. Avoid clicking on suspicious links or content within the affected application.