Endpoint users can inject malicious Perl commands by modifying the DATE parameter in the /cgi-bin/logs_ids.cgi script. The value is incorporated into a file path passed to a Perl open() call without proper filtering, allowing an attacker to execute arbitrary operating‑system commands. This flaw enables a threat actor to take full control of the affected firewall appliance, compromising confidentiality, integrity, and availability.

The vulnerability affects Endian Firewall products running version 2.1.2, 2.4, 3.3.25 and the community edition. An authenticated user is required to leverage the flaw; the attack vector is via the web interface where the manipulated DATE parameter is processed.

The flaw is assigned a CVSS score of 8.7, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low probability of widespread exploitation. Endian Firewall is not listed in the CISA KEV catalog, but the nature of the flaw allows remote command execution by authenticated users. The exploit path involves sending a crafted HTTP request to the web interface, modifying the DATE field, and triggering the Perl open() call to run injected commands.