CVE-2026-34801
Stored XSS in Endian Firewall DHCP Fixed Leases Management
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endian | firewall_community | to 3.3.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34801 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall versions 3.3.25 and earlier. It occurs because the 'remark' parameter in the web interface endpoint /manage/dhcp/fixed_leases/ does not properly neutralize input. An authenticated attacker can inject arbitrary JavaScript code via this parameter, which is then stored on the server.
When other users view the affected page, the injected JavaScript executes in their browsers, potentially leading to malicious actions.
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to inject and store malicious JavaScript code that executes in the browsers of other users viewing the affected page.
- It can lead to unauthorized actions performed on behalf of other users.
- It may result in theft of user credentials or session tokens.
- It can cause a loss of user trust and potential compromise of user data.
The overall impact is limited to confidentiality and integrity with no direct impact on availability, and the attack requires authentication and some user interaction.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored cross-site scripting (XSS) via the remark parameter in the /manage/dhcp/fixed_leases/ endpoint of Endian Firewall versions 3.3.25 and prior.
To detect this vulnerability, you should verify if your Endian Firewall version is 3.3.25 or earlier and check for suspicious or unexpected JavaScript code stored in the remark parameter of the DHCP fixed leases configuration.
Since the vulnerability requires authentication, detection can involve reviewing the web interface logs or database entries related to DHCP fixed leases for injected scripts.
There are no specific commands provided in the available resources to detect this vulnerability directly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-34801 affects compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Endian Firewall to a version later than 3.3.25 where this vulnerability is fixed.
Until an upgrade is possible, restrict access to the /manage/dhcp/fixed_leases/ endpoint to trusted authenticated users only.
Additionally, review and sanitize any existing entries in the remark parameter to remove any injected JavaScript code.
Implement web application firewall (WAF) rules to detect and block attempts to inject scripts via the remark parameter.