The vulnerability allows an authenticated user to execute arbitrary operating‑system commands by manipulating the DATE parameter in /cgi-bin/logs_proxy.cgi. The input is incorporated into a file path used by a Perl open() call; a faulty regular expression fails to filter malicious content, leading to command injection. This weakness can compromise the confidentiality, integrity, and availability of the affected system, enabling an attacker to execute arbitrary code with the privileges of the web service account.

Endian Firewall systems, including community and commercial editions, are affected. Versions up to and including 3.3.25, as well as earlier releases 2.1.2 and 2.4, are vulnerable. The issue persists across all supported builds addressed by the listed CPEs.

The CVSS v3.1 score of 8.7 indicates a high severity risk. EPSS indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet seen widespread exploitation in the wild. Exploitation requires authenticated access to the web interface; the attacker must log in with valid credentials, then submit a crafted DATE value to trigger the injection. While not a zero‑day, the combination of high impact and authenticated requirement makes it a priority for remediation.