Authenticated users of Endian Firewall version 3.3.25 and earlier can exploit a flaw in the DATE parameter of /cgi-bin/logs_smtp.cgi to inject OS commands. The application constructs a file path directly from the DATE value and passes it to a Perl open() call. Because the input is only partially filtered, an attacker can execute arbitrary commands on the host. This vulnerability falls under the operating-system command injection weakness.

Affected products are Endian Firewall versions 2.1.2, 2.4, and 3.3.25 or earlier. Any deployment of these versions that allows users to authenticate to the web interface and use the logs_smtp.cgi endpoint is vulnerable.

The CVSS score of 8.7 indicates a high severity with significant impact on confidentiality, integrity, and availability. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, suggesting it is not a widely exploited target yet. The likely attack vector requires authenticated access to the web interface, meaning an attacker must have valid credentials. Once authenticated, they can execute arbitrary commands, potentially escalating privileges further if the service runs with elevated rights.