An authenticated user can supply a crafted DATE parameter to /cgi-bin/logs_proxy.cgi on Endian Firewall, which is then used directly in a Perl open() call without proper validation. This flaw allows the attacker to inject and execute arbitrary operating‑system commands, giving full control over the host. The vulnerability is a classic command injection, classified as CWE-78, and can compromise confidentiality, integrity, and availability of the compromised firewall and any devices it protects.

Endian Firewall products, specifically versions 2.1.2, 2.4, and 3.3.25 or earlier, expose the vulnerable /cgi-bin/logs_proxy.cgi endpoint to authenticated users. The flaw exists across these releases and affects all installations that allow user authentication to this CGI script.

The CVSS score of 8.7 reflects a high severity assessment, and although EPSS data is not available, the absence from CISA’s KEV list suggests no known widespread exploitation yet. The most likely attack vector is an authenticated internal or remote user sending a malicious DATE value to the CGI script, possibly automated. Because the flaw operates from legitimate credentials, it has a low barrier to exploitation and poses a significant threat to environments running these firewall versions.