The vulnerability in Endian Firewall’s /cgi-bin/logs_smtp.cgi allows an authenticated user to supply a crafted DATE parameter that is used to build a file path. Because the input is not properly validated, the resulting path is passed to a Perl open() call, permitting injection of arbitrary shell commands. This flaw can lead to manipulation of system files, execution of malicious code, or escalation of privileges on the firewall appliance.

Endian Firewall versions 3.3.25 and all earlier releases, including 2.1.2, 2.4, and the community edition, are impacted. Any deployment of these firmware releases that exposes the logs_smtp.cgi interface to authenticated users is vulnerable.

The CVSS score of 8.7 categorizes this issue as high severity, yet the EPSS score of less than 1% suggests a low probability of being exploited currently. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication, implying that only users with legitimate access to the firewall can trigger command injection. The lack of widespread exploitation evidence may reflect the need for privileged access and lack of public exploit code, but the potential damage remains significant if an attacker gains or escalates credentials.