CVE-2026-34803: Endian Firewall Stored XSS Vulnerability

CVE-2026-34803 Overview

CVE-2026-34803 is a stored cross-site scripting (XSS) vulnerability affecting Endian Firewall version 3.3.25 and prior versions. The vulnerability exists in the Quality of Service (QoS) management interface, specifically in the name parameter submitted to the /manage/qos/classes/ endpoint. An authenticated attacker can inject arbitrary JavaScript code that gets persistently stored in the application and executed whenever other users navigate to the affected page.

Critical Impact

Authenticated attackers can inject malicious JavaScript that executes in the context of other administrative users' browsers, potentially leading to session hijacking, credential theft, or unauthorized administrative actions on the firewall.

Affected Products

• Endian Firewall version 3.3.25
• Endian Firewall versions prior to 3.3.25

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34803 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34803

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as stored cross-site scripting. The Endian Firewall web management interface fails to properly sanitize user-supplied input in the name parameter when creating or modifying QoS classes. Because the malicious payload is stored server-side in the application's database, any user who subsequently views the QoS classes page will have the injected JavaScript execute in their browser session.

The persistent nature of this XSS vulnerability makes it particularly dangerous in multi-administrator environments, as a lower-privileged authenticated user could potentially compromise higher-privileged administrator accounts. The attack requires network access to the management interface and valid authentication credentials, which somewhat limits the attack surface.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the QoS class management functionality. When administrators create or edit QoS classes through the /manage/qos/classes/ endpoint, the application accepts the name parameter without properly sanitizing HTML and JavaScript content. The unescaped data is then rendered directly in the browser when the page is displayed to users, allowing script execution in the context of the victim's authenticated session.

Attack Vector

The attack is network-based and requires authenticated access to the Endian Firewall management interface. An attacker would need to:

1. Obtain valid credentials for the Endian Firewall management interface
2. Navigate to the QoS class management section at /manage/qos/classes/
3. Create or modify a QoS class, injecting JavaScript code into the name parameter
4. Wait for another administrator to view the QoS classes page, triggering execution of the malicious script

The injected JavaScript executes with the full privileges of the victim's browser session, potentially allowing cookie theft, session hijacking, or execution of unauthorized administrative actions. For detailed technical analysis, see the VulnCheck Advisory on XSS.

Detection Methods for CVE-2026-34803

Indicators of Compromise

• Unexpected or suspicious QoS class names containing HTML tags, script elements, or encoded characters in the /manage/qos/classes/ interface
• JavaScript event handlers embedded in QoS class configurations (e.g., onerror, onload, onclick)
• Unusual administrative actions performed without corresponding legitimate administrator activity
• Web application firewall logs showing XSS patterns in POST requests to /manage/qos/classes/

Detection Strategies

• Monitor HTTP POST requests to /manage/qos/classes/ for payloads containing <script>, javascript:, or HTML event handlers
• Implement Content Security Policy (CSP) headers to detect inline script execution attempts
• Review audit logs for QoS class creation or modification by users who normally don't manage QoS settings
• Deploy web application firewall rules to inspect and block XSS patterns in the name parameter

Monitoring Recommendations

• Enable verbose logging on the Endian Firewall management interface to capture all administrative actions
• Configure network intrusion detection systems (IDS) to alert on XSS signature patterns targeting the management interface
• Implement session monitoring to detect anomalous behavior following QoS class page views
• Regularly audit QoS class configurations for suspicious or unexpected entries

How to Mitigate CVE-2026-34803

Immediate Actions Required

• Restrict access to the Endian Firewall management interface to trusted networks and IP addresses only
• Review all existing QoS class configurations for potential injected scripts and remove suspicious entries
• Implement additional network segmentation to limit exposure of the management interface
• Consider deploying a reverse proxy with XSS filtering capabilities in front of the management interface

Patch Information

Consult the Endian Community Support portal for the latest security updates and patch availability. Organizations should apply vendor-provided patches as soon as they become available.

Workarounds

• Limit administrative access to the Endian Firewall to a minimal number of trusted users
• Disable or restrict access to the QoS management functionality if not required for operations
• Implement strict Content Security Policy headers via a reverse proxy to prevent inline script execution
• Use browser extensions that block JavaScript execution when accessing the management interface for configuration review
• Monitor and audit all QoS class changes through alternative logging mechanisms

Organizations should deploy security controls at the network level while awaiting an official patch. Consider implementing web application firewall (WAF) rules to filter malicious input targeting the vulnerable endpoint.