PT-2026-29757 · Endian Technologies · Endian Firewall

Alex Williams + 1 · Published 2026-04-02 · Updated 2026-04-07 · CVE-2026-34797

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Endian Firewall versions 3.3.25 and prior

Description Endian Firewall versions 3.3.25 and earlier allow authenticated users to execute arbitrary OS commands through the DATE parameter in the '/cgi-bin/logs smtp.cgi' endpoint. The vulnerability arises from an incomplete regular expression validation when constructing a file path using the DATE parameter value, which is then passed to a Perl open() call, leading to command injection.

Recommendations Update Endian Firewall to a version later than 3.3.25.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34797

Affected Products

Endian Firewall

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-34797 · Security Note
• https://twitter.com/FirmisLabs/status/2041638099982409796 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040006586178146594 · Twitter Post
• https://twitter.com/CVEnew/status/2039744320064921878 · Twitter Post
• https://help.endian.com/hc/en-us/sections/360004371358-Community · Note
• https://twitter.com/CveFindCom/status/2039730754150646036 · Twitter Post
• https://vulncheck.com/advisories/endian-firewall-cgi-bin-logs-smtp-cgi-date-perl-command-injection · Note