EUVD-2026-18274
GHSA-4qwj-j599-qqw3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
AnalysisAI
Remote code execution in Endian Firewall versions ≤3.3.25 allows authenticated users with low privileges to execute arbitrary operating system commands through command injection in the logs_openvpn.cgi DATE parameter. The vulnerability stems from inadequate input validation in a Perl open() call, enabling attackers to break out of intended file path operations. CVSS 8.7 reflects the severe impact (complete system compromise) despite requiring authentication. EPSS and KEV data not provided; no public exploit identified at time of analysis, though the technical details disclosed suggest exploitation development is straightforward for authenticated attackers.
Technical ContextAI
This vulnerability exploits a classic Perl security anti-pattern in the open() function. When Perl's two-argument open() receives user-controlled input containing shell metacharacters (such as pipe characters), it interprets them as commands rather than literal filename characters. The Endian Firewall CGI script /cgi-bin/logs_openvpn.cgi accepts a DATE parameter intended for constructing log file paths, but applies an incomplete regular expression that fails to sanitize command injection payloads. An attacker can craft DATE values like '2024-01-01|id|' where the pipe character causes Perl to execute 'id' as a system command. This is classified as CWE-78 (OS Command Injection), a weakness arising from improper neutralization of special elements before passing data to system execution contexts. The vulnerability affects the web management interface, which typically runs with elevated privileges on firewall appliances, amplifying the impact beyond typical web application command injection.
RemediationAI
Organizations running Endian Firewall 3.3.25 or earlier must immediately check for vendor security updates addressing CVE-2026-34796. Contact Endian support through their official channels at https://help.endian.com/hc/en-us/sections/360004371358-Community to obtain patched versions or security guidance, as no vendor-released patch version is independently confirmed from available data at time of analysis. As an interim mitigation, restrict access to the Endian Firewall web administration interface to trusted IP addresses only, implement network segmentation to isolate management interfaces from broader user populations, audit existing user accounts with web interface access and remove unnecessary privileges, and enable comprehensive logging for /cgi-bin/ access to detect exploitation attempts. Review authentication logs for suspicious DATE parameter values containing shell metacharacters (pipes, semicolons, backticks). Organizations should prioritize patching given the severity and the relatively small attack surface of firewall management interfaces. For detailed vulnerability analysis, consult the VulnCheck advisory at https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-logs-openvpn-cgi-date-perl-command-injection.
More in Firewall Community
View allEndian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell m
Remote command execution in Endian Firewall Community Edition 3.3.25 and earlier allows authenticated users to inject ar
Remote code execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers with low-level privileges to
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated attackers to execute arbitrary OS co
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall 3.3.25 and earlier allows authenticated users with low privileges to inject
Remote command execution in Endian Firewall Community ≤3.3.25 allows authenticated users to inject OS commands through t
Directory traversal in Endian Firewall 3.3.25 and earlier allows authenticated users to delete arbitrary files through t
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject arbitrary
Stored cross-site scripting in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious JavaS
Stored cross-site scripting (XSS) in Endian Firewall 3.3.25 and prior allows authenticated attackers to inject malicious
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today