VULNERABILITY INTELLIGENCE

CVE-2026-34817

CVSS score6.4 MEDIUM

EPSS probability0.14%

CISA KEVNot currently listed

Published2026-04-02

Last modified2026-07-24

Description

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.