CVE-2026-34823 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall versions up to 3.3.25. The issue arises from improper neutralization of input in the remark parameter of the /manage/password/web/ page, allowing an authenticated attacker to inject and store malicious JavaScript. This script executes in the context of other users who view the page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authentication and user interaction to trigger. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, and partial impact on integrity and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users viewing the affected page, which can lead to session hijacking, unauthorized actions, or information disclosure within the context of the Endian Firewall management interface. The impact is limited by the requirement for attacker authentication and user interaction to trigger the stored script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and consider implementing input validation or output encoding workarounds if feasible. Monitor for updates from Endian regarding patches or official mitigations.