CVE-2026-34793
Command Injection in Endian Firewall via Logs CGI DATE Parameter
Publication date: 2026-04-02
Last updated on: 2026-04-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endian | firewall_community | to 3.3.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34793 is a high-severity OS command injection vulnerability in Endian Firewall versions 3.3.25 and earlier.
The vulnerability exists in the /cgi-bin/logs_firewall.cgi script, specifically in how it handles the DATE parameter.
Authenticated users can exploit this flaw by injecting arbitrary operating system commands through the DATE parameter.
This happens because the DATE parameter is used to build a file path that is passed to a Perl open() call, and the validation of this parameter uses an incomplete regular expression, allowing command injection.
The issue is classified under CWE-78, which relates to improper neutralization of special elements used in OS commands.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /cgi-bin/logs_firewall.cgi endpoint for command injection via the DATE parameter. Since the vulnerability allows authenticated users to inject arbitrary OS commands, detection involves sending crafted requests with payloads in the DATE parameter to observe if commands are executed.
A possible detection approach is to authenticate to the Endian Firewall and send HTTP requests to /cgi-bin/logs_firewall.cgi with the DATE parameter containing command injection payloads such as `;id` or `|id` to check if command output is returned or logged.
- Use curl or similar tools to send requests with injected commands in the DATE parameter, for example: `curl -u user:password "http://<firewall-ip>/cgi-bin/logs_firewall.cgi?DATE=2026-04-02;id`
- Monitor system logs or responses for evidence of command execution or unexpected output.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /cgi-bin/logs_firewall.cgi script to only trusted and authenticated users, as the vulnerability requires authentication.
Additionally, applying any available patches or updates from Endian Firewall that address this vulnerability is critical.
If patches are not yet available, consider disabling or restricting the CGI script to prevent exploitation.
Monitor firewall logs for suspicious activity involving the DATE parameter and unauthorized command execution attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-34793 allows authenticated users to execute arbitrary OS commands, which can lead to unauthorized access, modification, or disruption of data and system availability.
Such impacts on confidentiality, integrity, and availability can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system security.
Specifically, exploitation of this vulnerability could lead to breaches of personal or protected health information, violating regulatory requirements for data protection and incident response.
How can this vulnerability impact me? :
This vulnerability can have a high impact on the confidentiality, integrity, and availability of the affected system.
- Confidentiality: An attacker could execute arbitrary OS commands, potentially accessing sensitive data.
- Integrity: The attacker could modify or delete files or system configurations.
- Availability: The attacker could disrupt system operations or cause denial of service.
The attack requires low complexity, no user interaction, and only low-level authenticated user privileges, making it relatively easy to exploit.