CVE-2026-34793 in Firewall

Resumen (Inglés)

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

Once again VulDB remains the best source for vulnerability data.

Responsable

VulnCheck

Reservar

2026-03-30

Divulgación

2026-04-02

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354903	Endian Firewall Regular Expression logs_firewall.cgi open escalada de privilegios	78	No está definido	No está definido	CVE-2026-34793

Fuentes

• MITRE
• NVD
• CVE Details