PT-2026-29755 · Endian Technologies · Endian Firewall

Alex Williams + 1 · Published 2026-04-02 · Updated 2026-04-04 · CVE-2026-34795

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Endian Firewall versions 3.3.25 and prior

Description Endian Firewall versions 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to the '/cgi-bin/logs log.cgi' API endpoint. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

Recommendations Update Endian Firewall to a version later than 3.3.25.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34795

Affected Products

Endian Firewall

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34795 · Security Note
• https://help.endian.com/hc/en-us/sections/360004371358-Community · Note
• https://twitter.com/CveFindCom/status/2039730680196653306 · Twitter Post
• https://twitter.com/CVEnew/status/2039744322925400122 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040353668680315179 · Twitter Post
• https://vulncheck.com/advisories/endian-firewall-cgi-bin-logs-log-cgi-date-perl-command-injection · Note