CVE-2026-34818 is a stored cross-site scripting (XSS) vulnerability affecting Endian Firewall version 3.3.25 and prior. The vulnerability arises from improper neutralization of input in the remark parameter on the /manage/dnsmasq/localdomains/ page. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored and later executed in the context of other users viewing the page, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who access the affected page. This can lead to theft of session tokens, manipulation of the user interface, or other client-side impacts. The vulnerability does not require high privileges but does require authentication and user interaction. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider monitoring for suspicious activity related to the remark parameter. Avoid using the affected version in production environments if possible.