CVE-2026-34801: Endian Firewall Stored XSS Vulnerability

CVE-2026-34801 Overview

A stored cross-site scripting (XSS) vulnerability exists in Endian Firewall version 3.3.25 and prior versions. The vulnerability is located in the DHCP fixed leases management interface and can be exploited through the remark parameter at the /manage/dhcp/fixed_leases/ endpoint. An authenticated attacker can inject arbitrary JavaScript code that is persistently stored on the server and executed in the browser context of any user who subsequently views the affected page.

This stored XSS vulnerability is particularly concerning in firewall management interfaces, as it could allow attackers to hijack administrator sessions, steal credentials, or perform unauthorized configuration changes through the compromised user's browser session.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript that executes when other users (including administrators) view the DHCP fixed leases page, potentially leading to session hijacking, credential theft, or unauthorized firewall configuration changes.

Affected Products

• Endian Firewall version 3.3.25
• Endian Firewall versions prior to 3.3.25

Discovery Timeline

• 2026-04-02 - CVE-2026-34801 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34801

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the DHCP management module of the Endian Firewall web interface, specifically in how the application handles user-supplied input in the remark field when creating or modifying fixed DHCP leases.

When an authenticated user submits data through the fixed leases configuration form, the remark parameter is stored in the application's database without adequate sanitization or encoding. Subsequently, when this data is rendered on the DHCP management page for viewing, the stored malicious payload is included in the page output without proper output encoding, causing the browser to interpret and execute the injected JavaScript code.

The network-based attack vector combined with the requirement for user interaction (viewing the affected page) and low privilege requirements means that while exploitation requires initial authenticated access, the impact extends to all users who access the compromised interface.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Endian Firewall web management interface. The application fails to properly sanitize user-controlled input in the remark parameter before storing it in the database, and critically, does not apply adequate HTML encoding when rendering this data back to users in the web interface.

This represents a classic stored XSS scenario where the trust boundary between user input and application output is not properly enforced, allowing arbitrary HTML and JavaScript to be injected into pages served to other users.

Attack Vector

The attack requires the following conditions:

1. Authentication: The attacker must have valid credentials to access the Endian Firewall management interface
2. Access to DHCP Management: The attacker needs permissions to create or modify fixed DHCP leases
3. Victim Interaction: An administrator or other user must subsequently view the DHCP fixed leases page containing the malicious payload

The attacker navigates to /manage/dhcp/fixed_leases/ and creates a new fixed lease entry, injecting malicious JavaScript code into the remark field. This payload is stored persistently and executes whenever another user views the page, potentially allowing the attacker to steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites.

Detection Methods for CVE-2026-34801

Indicators of Compromise

• Unusual or unexpected JavaScript code present in DHCP fixed lease remark fields
• Presence of HTML tags or script elements (such as <script>, <img>, <iframe>, or event handlers like onerror, onload) in the remark parameter values in application logs
• Unexpected network requests from the firewall management interface to external domains
• Reports from users of unexpected browser behavior when accessing the DHCP management pages

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS patterns in POST requests to /manage/dhcp/fixed_leases/
• Review application logs for suspicious characters or HTML/JavaScript syntax in form submissions
• Monitor for outbound connections from administrator workstations to unexpected domains after accessing the firewall management interface
• Conduct periodic audits of stored data in DHCP fixed lease configurations for signs of injected content

Monitoring Recommendations

• Enable detailed logging for all requests to the Endian Firewall management interface, particularly POST operations
• Configure Content Security Policy (CSP) headers to restrict script execution sources, which can help mitigate the impact of successful XSS injection
• Implement alerting for any database entries containing potentially dangerous patterns in user-input fields
• Use browser developer tools or network monitoring to identify unexpected script execution when accessing management interfaces

How to Mitigate CVE-2026-34801

Immediate Actions Required

• Review all existing DHCP fixed lease entries for any suspicious content in the remark fields
• Restrict access to the Endian Firewall management interface to trusted administrators only
• Implement network segmentation to limit which systems can access the firewall management interface
• Consider temporarily disabling the DHCP fixed lease functionality if not critically needed until a patch is available
• Educate administrators about the risk and advise them to avoid clicking on unexpected elements when using the management interface

Patch Information

At the time of publication, no official patch has been released for this vulnerability. Organizations should monitor the Endian Community Support page for security updates and patch announcements. Additional technical details are available in the VulnCheck Advisory on Endian Firewall.

Workarounds

• Implement a web application firewall (WAF) or reverse proxy in front of the Endian Firewall management interface to filter malicious input patterns
• Restrict management interface access to specific trusted IP addresses or networks using network-level access controls
• Use browser extensions that block JavaScript execution or enable strict CSP enforcement when accessing the management interface
• Regularly audit DHCP fixed lease entries and sanitize any suspicious content manually
• Consider implementing multi-factor authentication to limit the impact of potential session hijacking

# Example: Restrict management interface access using iptables
# Only allow access from trusted management network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP