CVE-2026-34800: Endian Firewall Stored XSS Vulnerability

CVE-2026-34800 Overview

Endian Firewall version 3.3.25 and prior versions contain a stored cross-site scripting (XSS) vulnerability in the uplink editor component. An authenticated attacker can inject arbitrary JavaScript code via the NAME parameter to /cgi-bin/uplinkeditor.cgi. The malicious script is stored server-side and executes whenever other users view the affected page, potentially enabling session hijacking, credential theft, or further attacks against the firewall management interface.

Critical Impact

Authenticated attackers can inject persistent JavaScript code that executes in the browsers of other administrators accessing the Endian Firewall management interface, potentially leading to session hijacking, privilege escalation, or administrative account compromise.

Affected Products

• Endian Firewall version 3.3.25
• Endian Firewall versions prior to 3.3.25

Discovery Timeline

• 2026-04-02 - CVE-2026-34800 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34800

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as stored cross-site scripting (XSS). The flaw exists in the Endian Firewall's uplink editor CGI script, which fails to properly sanitize user-supplied input in the NAME parameter before storing it in the application database and rendering it back to users.

Stored XSS vulnerabilities are particularly dangerous in firewall management interfaces because they can persist across sessions and affect multiple administrators. When an authenticated user with lower privileges injects malicious JavaScript, the payload is stored and subsequently executed in the browser context of any administrator who views the compromised page. This can lead to session cookie theft, unauthorized configuration changes, or complete administrative account takeover.

The vulnerability requires authentication to exploit, limiting the attack surface to users who already have valid credentials to the Endian Firewall management interface. However, in multi-administrator environments or where lower-privileged accounts exist, this presents a significant horizontal and vertical privilege escalation risk.

Root Cause

The root cause is improper input validation and output encoding in the /cgi-bin/uplinkeditor.cgi script. The NAME parameter accepts user input without proper sanitization or HTML entity encoding before storing and displaying the data. This allows attackers to inject HTML and JavaScript code that is interpreted by the browser as part of the legitimate page content.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the Endian Firewall management interface. The attacker submits a crafted request to /cgi-bin/uplinkeditor.cgi containing malicious JavaScript in the NAME parameter. The payload is stored by the application and executed in the browser of any subsequent user who views the page containing the injected content.

The vulnerability can be exploited by injecting JavaScript payloads through the NAME parameter in the uplink editor interface. When the malicious input is stored and later rendered without proper encoding, the injected script executes in the victim's browser context. Typical payloads might attempt to steal session cookies, perform actions on behalf of the administrator, or redirect users to malicious sites. For detailed technical information, see the VulnCheck Advisory.

Detection Methods for CVE-2026-34800

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in uplink configuration names within the Endian Firewall interface
• Web server logs showing requests to /cgi-bin/uplinkeditor.cgi with suspicious NAME parameter values containing script tags or event handlers
• Browser developer console errors or unexpected script executions when viewing the uplink editor pages
• Anomalous session activity or unauthorized configuration changes following administrative page access

Detection Strategies

• Monitor HTTP request logs for POST requests to /cgi-bin/uplinkeditor.cgi containing potential XSS payloads such as <script>, javascript:, onerror=, or similar injection patterns
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to identify and alert on XSS payload patterns in request parameters
• Review stored configuration data for anomalous or unexpected content that may indicate injection attempts

Monitoring Recommendations

• Enable detailed logging for all administrative actions within the Endian Firewall management interface
• Configure alerts for multiple failed or suspicious authentication attempts followed by successful logins
• Monitor for outbound connections from administrator browsers to unexpected external domains that may indicate data exfiltration
• Implement session monitoring to detect unusual activity patterns following page views in the affected component

How to Mitigate CVE-2026-34800

Immediate Actions Required

• Restrict access to the Endian Firewall management interface to trusted networks and IP addresses only
• Implement strong Content Security Policy (CSP) headers to prevent inline script execution
• Review and audit all existing uplink configurations for signs of injected malicious content
• Consider disabling the uplink editor functionality if not required until a patch is available

Patch Information

At the time of publication, no official patch has been released. Users should monitor the Endian Community Support page for security updates and apply patches immediately when available.

Workarounds

• Restrict management interface access to specific trusted IP addresses or VPN connections
• Implement network segmentation to limit which users can reach the firewall management interface
• Deploy a reverse proxy or WAF with XSS filtering capabilities in front of the management interface
• Regularly review stored configurations and uplink names for suspicious content

# Example: Restrict management interface access via iptables
# Add rules to allow management access only from trusted admin subnet
iptables -A INPUT -p tcp --dport 10443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10443 -j DROP