The vulnerability arises in Endian Firewall versions 3.3.25 and earlier, where the DATE parameter supplied to /cgi-bin/logs_firewall.cgi is used directly in a Perl open() call without proper validation. This allows an authenticated user to inject arbitrary OS commands, resulting in remote command execution with the privileges of the web service process. The attack compromises confidentiality, integrity, and availability, enabling full control over the firewall appliance.

Affected versions include Endian Firewall 2.1.2, 2.4, and 3.3.25. Users running any of these releases should evaluate whether their deployment uses the logs_firewall.cgi endpoint and whether they have authenticated access. The vulnerability affects only systems with the web interface enabled and an authorized user’s credentials.

The CVSS score of 8.7 indicates high severity. Although no EPSS score is available, the fact that the flaw is exploitable by any authenticated user makes it highly attractive to attackers. The vulnerability is not listed in the CISA KEV catalog, but attackers could still leverage the flaw over the network by authenticating to the firewall’s web GUI. Mitigating it requires installing the vendor patch or upgrading to a version where the DATE parameter is properly sanitised.