The vulnerability originates from the DATE parameter sent to /cgi-bin/logs_openvpn.cgi. Endian Firewall versions 3.3.25 and earlier interpolate this parameter into a file path that is then passed to a Perl open() function. Because input validation relies on an incomplete regular expression, an attacker can inject arbitrary shell commands to be executed by the server, providing a remote code execution path. This weakness corresponds to CWE‑78, indicating OS command injection.

Endian Firewall is the affected product. Versions 2.1.2, 2.4, and 3.3.25, and all earlier releases are vulnerable. Administrative or authenticated users who can access the affected CGI script are required for exploitation.

The CVSS v3.1 score of 8.7 classifies this flaw as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of publicly known exploits does not diminish the inherent risk. As the flaw requires authenticated access, successful exploitation is limited to internal or compromised accounts, yet the command execution payload can compromise the entire firewall appliance.