CVE-2026-34799

medium

Description

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

References

https://www.vulncheck.com/advisories/endian-firewall-manage-dnsmasq-hosts-remark-stored-cross-site-scripting

https://help.endian.com/hc/en-us/sections/360004371358-Community

Details

Source: Mitre, NVD

Published: 2026-04-02

Updated: 2026-04-02

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N