CVE-2026-34804: Endian Firewall Stored XSS Vulnerability

CVE-2026-34804 Overview

CVE-2026-34804 is a stored Cross-Site Scripting (XSS) vulnerability affecting Endian Firewall version 3.3.25 and prior versions. The vulnerability exists in the QoS (Quality of Service) rules management interface, specifically in the handling of the dscp parameter at the /manage/qos/rules/ endpoint. An authenticated attacker can inject arbitrary JavaScript code that is stored on the server and subsequently executed when other users view the affected page.

Critical Impact
Authenticated attackers can inject persistent malicious JavaScript code into the firewall administration interface, potentially compromising other administrator sessions, stealing credentials, or performing unauthorized actions on behalf of legitimate users.

Affected Products

Endian Firewall version 3.3.25
Endian Firewall versions prior to 3.3.25
Endian Community Firewall (affected versions)

Discovery Timeline

2026-04-02 - CVE-2026-34804 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34804

Vulnerability Analysis

This stored XSS vulnerability resides in the QoS rules management functionality of the Endian Firewall web interface. When an authenticated user creates or modifies QoS rules, the application fails to properly sanitize user-supplied input in the dscp (Differentiated Services Code Point) parameter before storing it in the database and rendering it in subsequent page views.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and represents a significant security risk in enterprise firewall environments. While the attack requires authentication, the stored nature of the XSS means that the malicious payload persists and executes every time the affected page is loaded by any user, including administrators with higher privileges.

The attack is network-accessible and requires low complexity to exploit, though it does depend on user interaction—specifically, another user must view the page containing the malicious payload. The primary impact is on the confidentiality and integrity of the downstream system context, as the attacker can potentially access session tokens, perform actions on behalf of other users, or inject additional malicious content.

Root Cause

The root cause of CVE-2026-34804 is insufficient input validation and output encoding in the Endian Firewall web application. The dscp parameter accepts user input that is directly stored without proper sanitization. When this data is later rendered in the web interface, it is not properly escaped, allowing embedded JavaScript code to execute in the context of the victim's browser session.

The DSCP field, which should only accept valid DSCP values (typically numeric values between 0-63), instead accepts arbitrary string input including HTML and JavaScript tags. This indicates a lack of both input validation (whitelisting valid values) and output encoding (escaping special characters before rendering).

Attack Vector

The attack requires an authenticated session on the Endian Firewall management interface. An attacker with valid credentials (even low-privileged access) can navigate to the QoS rules configuration at /manage/qos/rules/ and inject malicious JavaScript into the dscp parameter when creating or modifying a QoS rule.

The malicious script is then stored in the firewall's configuration database. When any other authenticated user—including administrators—views the QoS rules page, the stored JavaScript executes in their browser context. This can be leveraged to steal session cookies, capture keystrokes, perform administrative actions, or redirect users to phishing pages.

The vulnerability mechanism involves injecting script tags or event handlers through the dscp parameter value. When the QoS rules page renders this unsanitized value, the browser interprets and executes the embedded code. For detailed technical information, refer to the VulnCheck Advisory.

Detection Methods for CVE-2026-34804

Indicators of Compromise

Presence of HTML tags or JavaScript code in QoS rule configurations, particularly in the dscp field
Unusual characters such as <script>, onerror, onload, or other event handlers in firewall configuration files
Web server logs showing requests to /manage/qos/rules/ with encoded script content in POST parameters
Reports from users of unexpected browser behavior when accessing the QoS management interface

Detection Strategies

Monitor web application logs for requests containing <script>, javascript:, or HTML event attributes in POST data to /manage/qos/rules/
Implement Web Application Firewall (WAF) rules to detect and block XSS payload patterns in requests to the Endian management interface
Conduct periodic audits of stored QoS rule configurations to identify any suspicious or non-standard values in the dscp field
Deploy browser-based XSS detection tools that can alert on unexpected script execution in administrative interfaces

Monitoring Recommendations

Enable detailed logging for all administrative actions on the Endian Firewall management interface
Configure SIEM alerts for patterns indicative of XSS exploitation attempts targeting the /manage/qos/rules/ endpoint
Implement Content Security Policy (CSP) headers where possible to restrict inline script execution
Monitor for anomalous administrative sessions that may indicate session hijacking following successful XSS exploitation

How to Mitigate CVE-2026-34804

Immediate Actions Required

Restrict access to the Endian Firewall management interface to trusted networks and IP addresses only
Review existing QoS rules for any suspicious entries containing script tags or JavaScript code
Implement network segmentation to limit exposure of the administrative interface
Consider temporarily disabling the QoS rules feature if not operationally required until a patch is available
Educate administrators about the risk and advise them to avoid accessing QoS configuration pages until remediation is complete

Patch Information

At the time of publication, consult the Endian Community Support for the latest security updates and patch availability. Organizations should monitor vendor channels for official security advisories addressing CVE-2026-34804.

Review the VulnCheck Advisory for additional technical details and remediation guidance.

Workarounds

Implement strict IP-based access controls to limit who can access the Endian Firewall management interface
Deploy a Web Application Firewall (WAF) in front of the management interface to filter malicious input patterns
Implement additional authentication factors for administrative access to reduce the risk of compromised credentials being used to inject payloads
Consider using browser isolation solutions when accessing the firewall management interface to contain potential XSS execution

bash

# Example: Restrict management interface access via iptables
# Allow management access only from trusted admin network
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Log suspicious requests for forensic analysis
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "ENDIAN-MGMT: "