PT-2026-29754 · Endian Technologies · Endian Firewall

Alex Williams + 1 · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34794

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Endian Firewall versions 3.3.25 and prior

Description Endian Firewall versions 3.3.25 and earlier allow authenticated users to execute arbitrary OS commands via the DATE parameter to the '/cgi-bin/logs ids.cgi' API endpoint. The DATE parameter value is used to construct a file path that is passed to a Perl open() function call. This allows command injection due to an incomplete regular expression validation.

Recommendations Update Endian Firewall to a version later than 3.3.25.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34794

Affected Products

Endian Firewall

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34794 · Security Note
• https://help.endian.com/hc/en-us/sections/360004371358-Community · Note
• https://twitter.com/CveFindCom/status/2039730641596567753 · Twitter Post
• https://twitter.com/CVEnew/status/2039744323973976066 · Twitter Post
• https://vulncheck.com/advisories/endian-firewall-cgi-bin-logs-ids-cgi-date-perl-command-injection · Note
• https://twitter.com/TheHackerWire/status/2040021433905266790 · Twitter Post