Executive brief
Endian Firewall, a security appliance used to protect network perimeters, contains a vulnerability that allows logged-in users to take full control of the system. By sending a specially crafted request to the log viewing component, an attacker can execute unauthorized commands. This could lead to a complete compromise of the firewall, allowing attackers to intercept network traffic or gain a foothold in the internal network.
Technical details
An OS command injection vulnerability (CWE-78) exists in Endian Firewall version 3.3.25 and prior within the /cgi-bin/logs_clamav.cgi script. The vulnerability stems from incomplete regular expression validation of the 'DATE' parameter. This user-supplied value is used to construct a file path that is subsequently passed to a Perl open() call. Because Perl's open() function can interpret certain characters as a pipe to execute commands, an authenticated attacker can inject arbitrary shell commands. Exploitation requires network access to the management interface and valid (low-privileged) user credentials.
Affected products
- Endian Firewall Community <= 3.3.25
Timeline
- 2026-04-02: disclosed
- 2026-04-02: advisory