Vulnerability · Published Apr 2, 2026 · Assigned by VulnCheck
CVE-2026-34795Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection
High 8.8
In plain English
A high-severity OS command injection in Endian Firewall from Endian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.5%top 25.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Endian | Endian Firewall | 3.3.25 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Endian Release Notes release-notes
- VulnCheck Advisory: Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection third-party-advisory