The vulnerability in Endian Firewall allows authenticated users to inject arbitrary OS commands by manipulating the DATE parameter in the /cgi-bin/logs_clamav.cgi script. The parameter is used to construct a file path that is passed to a Perl open() call, and the incomplete regular‑expression validation permits command injection, as identified by CWE-78.

Endian Firewall versions 3.3.25 and earlier—including 2.1.2, 2.4, 3.3.25, and community builds—are affected. All platforms running these firewall releases can be impacted if an attacker obtains authenticated access.

The CVSS score of 8.7 denotes a high severity vulnerability, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the firewall and the ability to send requests to the vulnerable CGI endpoint. Once authenticated, an attacker can execute arbitrary commands on the underlying system.