Authenticated users can trigger deletion of arbitrary files by exploiting directory traversal in the remove ARCHIVE parameter of /cgi-bin/backup.cgi. The application constructs a file path from the unsanitized input and calls unlink(), allowing a logged‑in user to delete any file on the firewall. This can destroy configuration data, logs, or other critical files, leading to loss of integrity and potential service disruption.

Endian Firewall versions 2.1.2, 2.4, 3.3.25 and the community edition are vulnerable. Any deployment using these firmware releases is susceptible to the flaw, regardless of size or location.

The CVSS score of 7.1 indicates high severity. The EPSS score is below 1%, suggesting low exploitation likelihood so far. It is not listed in the CISA KEV catalog. As the flaw requires authentication, the attacker must first log into the firewall with a privileged account, then send a crafted request to /cgi-bin/backup.cgi containing a directory traversal sequence. Successful exploitation would allow the removal of arbitrary files, severely compromising system integrity.