CVE-2026-34791
Command Injection in Endian Firewall Logs_Proxy CGI Module
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endian | firewall_community | to 3.3.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34791 is a high-severity OS command injection vulnerability in Endian Firewall versions 3.3.25 and earlier.
The vulnerability exists in the /cgi-bin/logs_proxy.cgi script, specifically in how it handles the DATE parameter.
Authenticated users can exploit this flaw to execute arbitrary operating system commands because the DATE parameter is used to build a file path passed to a Perl open() call without proper sanitization.
An incomplete regular expression validation fails to neutralize special characters, allowing command injection.
This issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
How can this vulnerability impact me? :
This vulnerability allows authenticated users to execute arbitrary operating system commands on the affected Endian Firewall system.
Such command execution can lead to unauthorized control over the firewall device, potentially compromising network security.
Attackers could manipulate system files, disrupt firewall operations, access sensitive data, or use the device as a pivot point for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual or unauthorized requests to the /cgi-bin/logs_proxy.cgi endpoint, specifically those containing the DATE parameter with suspicious or special characters that may indicate command injection attempts.
Since the vulnerability requires authentication, checking authenticated user activity logs for requests to /cgi-bin/logs_proxy.cgi with manipulated DATE parameters can help identify exploitation attempts.
- Use web server access logs to search for requests to /cgi-bin/logs_proxy.cgi with the DATE parameter, for example:
- grep "/cgi-bin/logs_proxy.cgi" /var/log/httpd/access_log | grep "DATE="
- Look for suspicious characters in the DATE parameter such as semicolons (;), backticks (`), or pipes (|) which are commonly used in command injection.
- Use intrusion detection system (IDS) rules or web application firewall (WAF) logs to detect attempts to exploit command injection via the DATE parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /cgi-bin/logs_proxy.cgi script to trusted users only and monitoring for suspicious activity.
Ensure that only authenticated and authorized users can access the affected endpoint.
If possible, apply any available patches or updates from Endian Firewall that address this vulnerability.
As a temporary workaround, disable or restrict the use of the DATE parameter in /cgi-bin/logs_proxy.cgi if feasible.
Implement input validation and sanitization controls to prevent command injection, such as filtering out special characters in the DATE parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated users to execute arbitrary OS commands on the affected Endian Firewall systems. Such unauthorized command execution can lead to unauthorized access, data breaches, or manipulation of sensitive information.
Consequently, exploitation of this vulnerability could result in violations of compliance requirements under standards like GDPR and HIPAA, which mandate protection of personal and sensitive data against unauthorized access and ensure system integrity.
Organizations using vulnerable versions of Endian Firewall may face increased risk of non-compliance due to potential data exposure or system compromise stemming from this flaw.