EUVD-2026-18270
GHSA-m82g-g4wp-pm4m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
AnalysisAI
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS commands with firewall appliance privileges via command injection in the DATE parameter of /cgi-bin/logs_ids.cgi. The vulnerability stems from incomplete regular expression validation before passing user input to Perl's open() function. CVSS score of 8.7 reflects network-accessible attack with low complexity requiring only low-privilege authentication. No CISA KEV listing or public exploit code identified at time of analysis, though VulnCheck public disclosure increases weaponization risk for organizations using this legacy firewall appliance.
Technical ContextAI
This vulnerability exploits a classic command injection weakness (CWE-78) in Perl CGI scripts through dangerous use of the open() function. The /cgi-bin/logs_ids.cgi endpoint accepts a DATE parameter intended for log file path construction, but employs insufficient input validation via regular expressions. Perl's open() function is notoriously dangerous when handling untrusted input because it interprets pipe characters and shell metacharacters, allowing attackers to append commands (e.g., DATE='valid_path|malicious_command|'). Endian Firewall is a Linux-based UTM appliance built on IPCop, commonly deployed as network perimeter security infrastructure. The affected CGI scripts run with elevated firewall appliance privileges, making successful exploitation particularly severe as it grants attackers control over the security boundary itself. This represents a fundamental secure coding failure where sanitization logic failed to account for all shell metacharacter sequences that Perl's open() interprets as command execution directives.
RemediationAI
Organizations running affected Endian Firewall versions should immediately assess migration options, as Endian Firewall Community Edition has reached end-of-life status and no vendor-released patch for CVE-2026-34794 has been identified at time of analysis. Primary remediation is to migrate to currently supported firewall platforms from active vendors. As interim risk reduction measures: restrict administrative interface access to trusted management networks only (never expose to internet); implement strict IP allowlisting for firewall administration; audit and minimize user accounts with any level of firewall access; monitor authentication logs and system command execution for suspicious activity patterns. Review firewall access control policies to ensure principle of least privilege, as the vulnerability requires authenticated access (PR:L). For mission-critical deployments unable to migrate immediately, consider deploying a reverse proxy with strict input validation in front of the administrative interface, though this workaround complexity may exceed migration effort. Consult VulnCheck advisory at vulncheck.com/advisories/endian-firewall-cgi-bin-logs-ids-cgi-date-perl-command-injection for additional technical indicators and vendor migration guidance at help.endian.com community resources.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbi
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through t
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today