EUVD-2026-18318Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
AnalysisAI
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaScript via the remark parameter in the DNS local domains management interface (/manage/dnsmasq/localdomains/). The injected payload persists in the application and executes when other authenticated users access the affected page, enabling session hijacking, credential theft, or malware distribution within the firewall management environment. No public exploit code or active exploitation has been reported.
Technical ContextAI
This is a classic stored cross-site scripting (CWE-79) vulnerability arising from insufficient input sanitization and output encoding in the Endian Firewall web management interface. The vulnerability exists in the DNS local domains management feature, where user-supplied input via the 'remark' parameter is stored in a backend data store without proper HTML entity encoding or Content Security Policy protection. When the affected page is rendered to other users, the malicious JavaScript executes in their browser context with the privileges of their authenticated session. The network-accessible web interface (AV:N) combined with low attack complexity (AC:L) means any authenticated administrator or operator can trivially craft and submit malicious input. The requirement for user interaction (UI:P) means the payload executes only when another user views the page, limiting but not eliminating impact to confidentiality and integrity of administrative sessions.
RemediationAI
Upgrade Endian Firewall to a patched version released after version 3.3.25. Consult the official Endian advisory at https://www.vulncheck.com/advisories/endian-firewall-manage-dnsmasq-localdomains-remark-stored-cross-site-scripting and the Endian Help Center (https://help.endian.com/hc/en-us/sections/360004371358-Community) for the specific fixed version and upgrade procedures. As an interim workaround, restrict administrative access to the firewall management interface to a minimal set of trusted users, enforce strong authentication and multi-factor authentication where supported, and monitor DNS local domains configuration changes through firewall audit logs. After patching, audit the DNS local domains remark fields for any suspicious entries that may have been injected by previous attackers.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbi
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS co
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through t
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today