CVE-2026-34799: Endian Firewall Stored XSS Vulnerability

CVE-2026-34799 Overview

Endian Firewall version 3.3.25 and prior versions contain a stored cross-site scripting (XSS) vulnerability in the DNS management interface. The vulnerability exists in the remark parameter of the /manage/dnsmasq/hosts/ endpoint, allowing authenticated attackers to inject arbitrary JavaScript code that persists in the application and executes when other users view the affected page.

This stored XSS vulnerability (CWE-79) enables attackers with authenticated access to compromise other users' sessions, including administrators, potentially leading to account takeover, privilege escalation, or further system compromise within the firewall management interface.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript into the firewall management interface, potentially compromising administrator sessions and gaining elevated access to network security controls.

Affected Products

• Endian Firewall version 3.3.25
• Endian Firewall versions prior to 3.3.25

Discovery Timeline

• 2026-04-02 - CVE-2026-34799 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34799

Vulnerability Analysis

This stored cross-site scripting vulnerability affects the DNS host management functionality within Endian Firewall's web-based administration interface. The vulnerability arises from improper input validation and output encoding in the remark parameter when creating or modifying DNS host entries through the /manage/dnsmasq/hosts/ endpoint.

When an authenticated user submits a DNS host configuration, the remark field is stored in the application database without proper sanitization. Subsequently, when any user—including administrators—views the DNS hosts configuration page, the unsanitized content is rendered directly into the HTML response, causing any embedded JavaScript to execute in the context of the viewing user's browser session.

The attack requires the attacker to have authenticated access to the firewall management interface, but once the malicious payload is stored, it will execute for any user who views the affected page. This makes the vulnerability particularly dangerous in multi-administrator environments where the attacker may target users with higher privileges.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of output encoding in the DNS host management module. The application fails to sanitize user-supplied input in the remark parameter before storing it in the database and does not properly encode the output when rendering the stored data back to users in the web interface.

Specifically, the application does not implement proper HTML entity encoding or Content Security Policy (CSP) headers that would prevent the execution of injected scripts. This allows JavaScript payloads embedded in the remark field to execute in the browser context of users viewing the DNS hosts page.

Attack Vector

The attack vector for this vulnerability is network-based and requires authenticated access to the Endian Firewall management interface. The exploitation flow follows these steps:

1. An attacker with valid credentials authenticates to the Endian Firewall web management interface
2. The attacker navigates to the DNS management section at /manage/dnsmasq/hosts/
3. When creating or editing a DNS host entry, the attacker injects malicious JavaScript code into the remark field
4. The payload is stored without sanitization in the application's database
5. When any other authenticated user (particularly administrators) views the DNS hosts page, the malicious script executes in their browser
6. The injected script can steal session cookies, perform actions on behalf of the victim, or redirect them to malicious sites

For detailed technical information about this vulnerability, refer to the VulnCheck Advisory.

Detection Methods for CVE-2026-34799

Indicators of Compromise

• Unusual JavaScript content or HTML tags present in DNS host remark fields within the Endian Firewall configuration
• Web server access logs showing requests to /manage/dnsmasq/hosts/ with suspicious encoded characters or script tags in POST parameters
• Unexpected session activity or administrative actions occurring after users access the DNS management interface
• Browser console errors or unexpected network requests originating from the firewall management interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in HTTP requests targeting the /manage/dnsmasq/hosts/ endpoint
• Monitor application logs for POST requests containing common XSS indicators such as <script>, javascript:, onerror=, or encoded variants in the remark parameter
• Deploy endpoint detection solutions to identify unusual browser behavior when administrators access the firewall management interface
• Conduct periodic reviews of DNS host configurations to identify entries with suspicious remark content

Monitoring Recommendations

• Enable detailed access logging on the Endian Firewall web interface and forward logs to a SIEM for centralized analysis
• Configure alerts for any modifications to DNS host entries, particularly those containing special characters or encoded content
• Monitor for unusual administrative session patterns, such as multiple actions performed in rapid succession after accessing the DNS management page
• Implement browser-based security controls and monitor for Content Security Policy violations if CSP headers are deployed

How to Mitigate CVE-2026-34799

Immediate Actions Required

• Restrict access to the Endian Firewall management interface to only trusted administrators from known IP addresses
• Review existing DNS host entries for any suspicious content in the remark fields and remove any identified malicious payloads
• Implement network segmentation to limit access to the firewall management interface from untrusted network segments
• Consider deploying a reverse proxy with XSS filtering capabilities in front of the management interface as an interim protective measure

Patch Information

As of the published date, check the Endian Help Community for the latest security updates and patch availability. Review the VulnCheck Advisory for detailed technical information and remediation guidance.

Organizations should monitor Endian's official channels for security patches addressing this XSS vulnerability and apply updates as soon as they become available.

Workarounds

• Implement strict IP-based access controls to limit which hosts can access the /manage/dnsmasq/hosts/ endpoint
• Deploy a web application firewall (WAF) rule to sanitize or block requests containing potential XSS payloads in the remark parameter
• Limit the number of users with access to DNS management functionality to reduce the attack surface
• Use browser extensions that provide XSS protection when accessing the management interface until a patch is available

# Example: Restrict management interface access via iptables
# Allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 10443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10443 -j DROP