CVE-2026-34791 in Firewall
摘要 (英语)
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
负责
VulnCheck
预定
2026-03-30
披露
2026-04-02
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354894 | Endian Firewall Regular Expression logs_proxy.cgi open 权限提升 | 78 | 未定义 | 未定义 | CVE-2026-34791 |