CVE-2026-34793 is an OS command injection vulnerability affecting Endian Firewall version 3.3.25 and prior. The issue arises because the DATE parameter passed to /cgi-bin/logs_firewall.cgi is used to construct a file path for a Perl open() call without proper sanitization. An incomplete regular expression validation allows authenticated users to inject arbitrary OS commands, leading to potential command execution on the underlying system. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an authenticated user to execute arbitrary OS commands on the Endian Firewall system, potentially compromising system integrity and confidentiality. This could lead to unauthorized control over the firewall device, impacting network security. The vulnerability requires authentication but no user interaction and has high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted personnel only and monitor for suspicious activity related to the /cgi-bin/logs_firewall.cgi endpoint. Avoid exposing the management interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.