CVE-2026-34819 is a stored cross-site scripting vulnerability in Endian Firewall version 3.3.25 and prior. The vulnerability arises from improper neutralization of input in the REMARK parameter of the /cgi-bin/openvpnclient.cgi endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code, which is then stored and executed in the context of other users viewing the affected page. This can lead to client-side script execution but requires authentication and user interaction.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page. This can lead to session hijacking, unauthorized actions performed on behalf of users, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability does not require elevated privileges beyond authentication and does not affect confidentiality, integrity, or availability directly on the server.

No official patch or remediation is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected interface to trusted users only and consider monitoring for suspicious activity related to the injection point. Avoid clicking on suspicious links or executing untrusted scripts in the affected environment.