CVE-2026-34820 in Firewall
Summary
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Responsible
VulnCheck
Reservation
03/30/2026
Disclosure
04/02/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354923 | Endian Firewall Parameter ipsec cross site scripting | 79 | Not defined | Not defined | CVE-2026-34820 |