CVE-2026-34792
Command Injection in Endian Firewall Logs ClamAV CGI Module
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endian | firewall_community | to 3.3.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34792 is a high-severity OS command injection vulnerability in Endian Firewall versions 3.3.25 and earlier.
The vulnerability exists in the /cgi-bin/logs_clamav.cgi script, specifically in how it handles the DATE parameter.
Authenticated users can exploit this flaw by injecting arbitrary operating system commands through the DATE parameter.
This happens because the DATE parameter value is used to build a file path that is passed to a Perl open() call, but the validation of this parameter is incomplete, allowing command injection.
The root cause is an incomplete regular expression validation, which fails to properly neutralize special elements used in OS commands.
How can this vulnerability impact me? :
This vulnerability can have a high impact on the confidentiality, integrity, and availability of the affected system.
- Confidentiality: An attacker could execute arbitrary commands, potentially accessing sensitive data.
- Integrity: The attacker could modify or corrupt data or system files.
- Availability: The attacker could disrupt system operations or cause denial of service.
The attack requires only low complexity and no user interaction but does require low-level authenticated user privileges.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /cgi-bin/logs_clamav.cgi endpoint for command injection via the DATE parameter. Since the vulnerability allows authenticated users to inject arbitrary OS commands, one approach is to send crafted requests with payloads in the DATE parameter that attempt to execute simple commands and observe the response or system behavior.
For example, after authenticating to the Endian Firewall, you could use curl or similar tools to send requests like:
- curl -k -u <username>:<password> 'https://<firewall-ip>/cgi-bin/logs_clamav.cgi?DATE=;id;'
- curl -k -u <username>:<password> 'https://<firewall-ip>/cgi-bin/logs_clamav.cgi?DATE=;uname -a;'
If the response contains output from these commands (e.g., user id info or system information), it indicates the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /cgi-bin/logs_clamav.cgi script to trusted users only, ensuring that only authorized authenticated users can reach this endpoint.
Additionally, monitor and audit authentication logs to detect any suspicious activity involving the DATE parameter.
Since the vulnerability arises from incomplete input validation, applying any available patches or updates from Endian Firewall to fix this issue is critical.
If patches are not yet available, consider disabling or restricting the use of the logs_clamav.cgi script until a fix is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-34792 allows authenticated users to execute arbitrary OS commands on Endian Firewall systems, which can lead to unauthorized access, modification, or disruption of sensitive data and system availability.
Such a vulnerability can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require the protection of data confidentiality, integrity, and availability.
Exploitation of this vulnerability could result in data breaches or system compromises that violate these regulatory requirements, potentially leading to legal and financial consequences.