CVE-2026-34821: Endian Firewall stored XSS in VPN user remark parameter

CVE-2026-34821 · Severity: medium · CVSS 6.4 · Published 2026-04-02

Endian Firewall, a security appliance used to protect corporate networks and manage VPN access, is vulnerable to a security flaw in its user management interface. An attacker with existing access to the system can inject malicious scripts into user profile fields. When an administrator or another user views the affected management page, these scripts could execute, potentially allowing the attacker to hijack sessions or perform unauthorized actions within the firewall management console.

Technologies: Endian Firewall Community. Vendors: Endian.

Quick answers

Is CVE-2026-34821 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34821 being exploited in the wild.
How severe is CVE-2026-34821?
Medium severity, with a CVSS score of 6.4, published 2 April 2026.
Which products and versions are affected?
Endian Endian Firewall <= 3.3.25.
Is there a fix for CVE-2026-34821?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34821 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34821?
Check whether you run Endian Firewall Community. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Endian Firewall versions up to and including 3.3.25. The vulnerability is located in the '/manage/vpnauthentication/user/' endpoint and is triggered by insufficient sanitization of the 'remark' parameter. An authenticated attacker with network access to the management interface can submit a malicious payload that is permanently stored on the server. When a different user (such as an administrator) navigates to the user management page, the payload executes in the context of their browser session. This can lead to session hijacking, unauthorized configuration changes, or further escalation within the management interface.

Affected products

  • Endian Endian Firewall <= 3.3.25

Timeline

  • 2026-04-02: disclosed
  • 2026-04-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.