CVE-2026-34796 is an OS command injection vulnerability in Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of special elements in the DATE parameter passed to the /cgi-bin/logs_openvpn.cgi endpoint. This parameter is used to construct a file path in a Perl open() call, but the regular expression validation is incomplete, enabling authenticated users to inject arbitrary OS commands. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

Successful exploitation allows an authenticated user to execute arbitrary operating system commands on the Endian Firewall device. This can lead to unauthorized system control, data compromise, or disruption of firewall operations. The vulnerability affects version 3.3.25 and earlier. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the affected endpoint and monitor for suspicious activity related to the DATE parameter. Avoid exposing the vulnerable interface to untrusted users.