CVE-2026-34820 is a stored cross-site scripting vulnerability affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the remark parameter on the /manage/ipsec/ endpoint, allowing authenticated users to inject arbitrary JavaScript. This script is stored and executed in the context of other users viewing the page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authentication and has a medium impact score (CVSS 5.1). No patch or vendor advisory details are currently available.

An authenticated attacker can exploit this vulnerability to inject and store malicious JavaScript code that executes in the browsers of other users who access the affected page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other client-side attacks. The vulnerability does not require elevated privileges beyond authentication and has a network attack vector with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing web application firewall rules to detect and block suspicious input in the remark parameter. Monitor vendor channels for updates regarding patches or official mitigations.