Authenticated users of Endian Firewall version 3.3.25 and earlier can influence the DATE parameter in the /cgi-bin/logs_firewall.cgi script. The supplied value is concatenated into a file path that is later passed directly to a Perl open() call. Because the validation regex does not exclude shell metacharacters, an attacker can inject OS commands, allowing execution of arbitrary commands on the underlying host. This weakness falls under CWE-78 and can lead to complete compromise of the firewall device, including disclosure of sensitive configuration, data exfiltration, and further network intrusion.

The vulnerability affects Endian Firewall products including the 2.1.2, 2.4, and 3.3.25 releases as well as the community edition. Any instance of Endian Firewall running these versions is susceptible to the flaw.

The CVSS base score for this issue is 8.7, indicating high severity, while the EPSS score is lower than 1%, suggesting a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog, reducing its exposure profile. Exploitation requires an authenticated session, so the attack vector is likely an internal attacker or an external actor who has obtained valid credentials. An attacker can send a crafted DATE value from a web browser or HTTP client to trigger the command injection, resulting in arbitrary code execution on the firewall host.