Skip to content
OpenAdvisories

Vendor

Endian

34 known vulnerabilities.

Endian at a glance

Last 12 months
34
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 25 50 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 34 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 2026340
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Endian Firewall 34
All Critical High Medium Low Exploited only Public exploit

34 results · Feed

  • Medium 6.4
    CVE-2026-34823

    Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34822

    Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affect…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34821

    Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affec…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34820

    Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34819

    Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected p…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34818

    Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affecte…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34817

    Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affecte…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34816

    Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affec…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34815

    Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected pag…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34814

    Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34813

    Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34811

    Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34812

    Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected …

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34810

    Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34809

    Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34807

    Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34808

    Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34806

    Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34805

    Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34803

    Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34804

    Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34802

    Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the af…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34801

    Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected p…

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34799

    Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34800

    Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • Medium 6.4
    CVE-2026-34798

    Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting

    Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34797

    Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_smtp.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows …

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34796

    Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allo…

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34795

    Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows c…

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34794

    Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows c…

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34793

    Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which all…

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34792

    Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_clamav.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allow…

    Endian Endian Firewall
  • High 8.8
    CVE-2026-34791

    Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection

    Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows…

    Endian Endian Firewall
  • High 7.1
    CVE-2026-34790

    Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal

    Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitizati…

    Endian Endian Firewall