CVE-2026-34798 in Firewall
Summary
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Responsible
VulnCheck
Reservation
03/30/2026
Disclosure
04/02/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354898 | Endian Firewall Parameter routing.cgi cross site scripting | 79 | Not defined | Not defined | CVE-2026-34798 |