EUVD-2026-18264Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
AnalysisAI
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through the DATE parameter in /cgi-bin/logs_proxy.cgi due to incomplete input validation in Perl open() calls. Attack requires only low-privilege authentication (CVSS PR:L) with network access and no user interaction. No public exploit identified at time of analysis, though the technical details disclosed by VulnCheck provide a clear exploitation path for threat actors.
Technical ContextAI
Endian Firewall is a network security appliance built on Linux that uses CGI scripts for administrative functions. The vulnerability exists in logs_proxy.cgi, where user-supplied DATE parameter values are incorporated into file paths passed directly to Perl's open() function. Perl's open() is notoriously dangerous when handling untrusted input because it interprets pipe characters (|) as shell command execution directives. The application attempted to validate input using a regular expression, but the pattern was incomplete and failed to block malicious payloads. This is a classic instance of CWE-78 (OS Command Injection via Special Elements) where metacharacter filtering is bypassed. The CGI execution context runs with elevated privileges typical of firewall management interfaces, allowing injected commands to execute with system-level access.
RemediationAI
Organizations running affected Endian Firewall Community versions should immediately upgrade to the latest patched release. Consult the official Endian support portal at help.endian.com/hc/en-us/sections/360004371358-Community for version-specific upgrade instructions and security bulletins. As an interim mitigation for environments unable to patch immediately, restrict network access to the firewall's administrative interface (/cgi-bin/ paths) to only trusted administrator IP addresses using firewall rules or access control lists. Monitor authentication logs for unusual access patterns to logs_proxy.cgi and review user account privileges to ensure principle of least privilege is enforced. Implement network segmentation to limit potential lateral movement if the firewall is compromised. Detailed vulnerability analysis is available from VulnCheck at vulncheck.com/advisories/endian-firewall-cgi-bin-logs-proxy-cgi-date-perl-command-injection for technical validation and detection engineering.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbi
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS co
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today