CVE-2026-34820
Stored XSS in Endian Firewall IPsec Remark Parameter
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endian | firewall_community | to 3.3.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34820 is a stored Cross-Site Scripting (XSS) vulnerability found in Endian Firewall versions 3.3.25 and earlier.
The vulnerability exists in the /manage/ipsec/ endpoint, specifically via the "remark" parameter.
An authenticated attacker can inject arbitrary JavaScript code into this parameter, which is then stored on the server.
When other users view the affected page, the injected JavaScript is executed in their browsers.
This issue is classified under CWE-79, which relates to improper neutralization of input during web page generation.
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to execute arbitrary JavaScript code in the browsers of other users who view the affected page.
Such execution can lead to theft of user credentials, session hijacking, or performing actions on behalf of the victim user.
The CVSS v4 base score of 5.1 indicates a medium severity with low impact on confidentiality, integrity, and availability, but it still poses a risk to user security and trust.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of malicious JavaScript code injected into the "remark" parameter on the /manage/ipsec/ endpoint of Endian Firewall versions 3.3.25 and earlier.
Since the vulnerability requires authentication, detection involves accessing the /manage/ipsec/ page with valid credentials and inspecting the remark parameter for suspicious or unexpected JavaScript code.
Commands to detect this might include using curl or similar tools to fetch the page and grep for script tags or suspicious content in the remark parameter, for example:
- curl -k -u <username>:<password> https://<firewall-ip>/manage/ipsec/ | grep -i '<script>'
- Alternatively, manual inspection via the web interface or using a web vulnerability scanner targeting stored XSS on the remark parameter can help detect exploitation.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict access to the /manage/ipsec/ endpoint to only trusted and authenticated users.
- Avoid entering untrusted input into the remark parameter until a patch or update is applied.
- Monitor and audit the remark parameter for any suspicious JavaScript code injections.
- Apply any available security updates or patches from Endian Firewall as soon as they are released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in Endian Firewall affects compliance with common standards and regulations such as GDPR or HIPAA.