CVE-2026-34796 in Firewall
摘要 (英语)
Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
负责
VulnCheck
预定
2026-03-30
披露
2026-04-02
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354896 | Endian Firewall Regular Expression logs_openvpn.cgi open 权限提升 | 78 | 未定义 | 未定义 | CVE-2026-34796 |