High severity8.8NVD Advisory· Published Apr 2, 2026· Updated Apr 7, 2026
CVE-2026-34793
CVE-2026-34793
Description
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.vulncheck.com/advisories/endian-firewall-cgi-bin-logs-firewall-cgi-date-perl-command-injectionnvdThird Party Advisory
- help.endian.com/hc/en-us/sections/360004371358-CommunitynvdRelease Notes
News mentions
0No linked articles in our index yet.