CVE-2026-34819 is a stored cross-site scripting (CWE-79) vulnerability in Endian Firewall version 3.3.25 and prior. It occurs due to improper neutralization of input in the REMARK parameter of the /cgi-bin/openvpnclient.cgi endpoint. An attacker with valid authentication can inject arbitrary JavaScript code that is stored on the server and executed in the context of other users when they access the affected page. This can lead to client-side script execution, potentially compromising user sessions or performing actions on behalf of the user.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page. This can lead to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability does not allow unauthenticated access or direct server compromise. The CVSS 4.0 score of 5.1 reflects a medium impact with network attack vector, low complexity, and limited scope.

No official patch or remediation guidance is provided in the available data. Since the vulnerability requires authentication, limiting access to the affected interface and applying strict input validation or sanitization on the REMARK parameter may reduce risk. Monitor the vendor's advisory channels for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.