Executive Summary

CVE-2026-34801 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall versions 3.3.25 and earlier. It occurs because the 'remark' parameter in the web interface endpoint /manage/dhcp/fixed_leases/ does not properly neutralize input. An authenticated attacker can inject arbitrary JavaScript code via this parameter, which is then stored on the server.

When other users view the affected page, the injected JavaScript executes in their browsers, potentially leading to malicious actions.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-34801 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to inject and store malicious JavaScript code that executes in the browsers of other users viewing the affected page.

• It can lead to unauthorized actions performed on behalf of other users.
• It may result in theft of user credentials or session tokens.
• It can cause a loss of user trust and potential compromise of user data.

The overall impact is limited to confidentiality and integrity with no direct impact on availability, and the attack requires authentication and some user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting (XSS) via the remark parameter in the /manage/dhcp/fixed_leases/ endpoint of Endian Firewall versions 3.3.25 and prior.

To detect this vulnerability, you should verify if your Endian Firewall version is 3.3.25 or earlier and check for suspicious or unexpected JavaScript code stored in the remark parameter of the DHCP fixed leases configuration.

Since the vulnerability requires authentication, detection can involve reviewing the web interface logs or database entries related to DHCP fixed leases for injected scripts.

There are no specific commands provided in the available resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Endian Firewall to a version later than 3.3.25 where this vulnerability is fixed.

Until an upgrade is possible, restrict access to the /manage/dhcp/fixed_leases/ endpoint to trusted authenticated users only.

Additionally, review and sanitize any existing entries in the remark parameter to remove any injected JavaScript code.

Implement web application firewall (WAF) rules to detect and block attempts to inject scripts via the remark parameter.

Useful 0 Not Useful 0