Compliance Impact

The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in Endian Firewall affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-34820 is a stored Cross-Site Scripting (XSS) vulnerability found in Endian Firewall versions 3.3.25 and earlier.

The vulnerability exists in the /manage/ipsec/ endpoint, specifically via the "remark" parameter.

An authenticated attacker can inject arbitrary JavaScript code into this parameter, which is then stored on the server.

When other users view the affected page, the injected JavaScript is executed in their browsers.

This issue is classified under CWE-79, which relates to improper neutralization of input during web page generation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to execute arbitrary JavaScript code in the browsers of other users who view the affected page.

Such execution can lead to theft of user credentials, session hijacking, or performing actions on behalf of the victim user.

The CVSS v4 base score of 5.1 indicates a medium severity with low impact on confidentiality, integrity, and availability, but it still poses a risk to user security and trust.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious JavaScript code injected into the "remark" parameter on the /manage/ipsec/ endpoint of Endian Firewall versions 3.3.25 and earlier.

Since the vulnerability requires authentication, detection involves accessing the /manage/ipsec/ page with valid credentials and inspecting the remark parameter for suspicious or unexpected JavaScript code.

Commands to detect this might include using curl or similar tools to fetch the page and grep for script tags or suspicious content in the remark parameter, for example:

• curl -k -u <username>:<password> https://<firewall-ip>/manage/ipsec/ | grep -i '<script>'
• Alternatively, manual inspection via the web interface or using a web vulnerability scanner targeting stored XSS on the remark parameter can help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Restrict access to the /manage/ipsec/ endpoint to only trusted and authenticated users.
• Avoid entering untrusted input into the remark parameter until a patch or update is applied.
• Monitor and audit the remark parameter for any suspicious JavaScript code injections.
• Apply any available security updates or patches from Endian Firewall as soon as they are released.

Useful 0 Not Useful 0