Cyber Posture

CVE-2026-34796

HighPublic PoC

Published: 02 April 2026

Published
02 April 2026
Modified
07 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0046 64.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which…

more

allows command injection due to an incomplete regular expression validation.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates command injection by requiring validation of the untrusted DATE parameter before its use in the Perl open() call.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the insufficient regex validation flaw in /cgi-bin/logs_openvpn.cgi to eliminate the vulnerability.

AC-6 Least Privilege partial match
prevent

Reduces impact of arbitrary command execution by low-privilege authenticated users through enforcement of least privilege.

Security SummaryAI

CVE-2026-34796 is a command injection vulnerability (CWE-78) in Endian Firewall version 3.3.25 and prior. The flaw resides in the /cgi-bin/logs_openvpn.cgi script, where the DATE parameter is used to build a file path passed directly to a Perl open() call. Insufficient regular expression validation on the parameter enables attackers to inject arbitrary OS commands.

An authenticated user with low privileges (PR:L) can exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants high-impact arbitrary command execution on the underlying OS, potentially compromising confidentiality, integrity, and availability.

Advisories providing mitigation guidance are available from Endian at https://help.endian.com/hc/en-us/sections/360004371358-Community and VulnCheck at https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-logs-openvpn-cgi-date-perl-command-injection.

Details

CWE(s)
CWE-78

Affected Products

endian
firewall community
≤ 3.3.25

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

The vulnerability is a command injection in a web CGI script (public-facing application exploitation, T1190) enabling arbitrary OS command execution on a Unix-based system (T1059.004: Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References