CVE-2026-34796Disclosure(endian / firewall_community)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch endian firewall_community systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

endian CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-logs-openvpn-cgi-date-perl-command-injection

Other references

https://help.endian.com/hc/en-us/sections/360004371358-Community

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firewall_community

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-04-02); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

endian

Products

firewall_community

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-02	2	Disclosure2
2026-04-03	1	Disclosure1
2026-04-07	1	Patch1

Full discourse4 posts

Firmis Labs@FirmisLabs184d
Patch
CVE-2026-34796 · NIST 8.8/10 https://nvd.nist.gov/vuln/detail/CVE-2026-34796 ask your AI: "check if my infrastructure uses Endian Firewall version 3.3.25 or earlier" then: "update Endian Firewall to the latest version and verify network logging still work correctly"
Post summary
The entry points to CVE-2026-34796 with a CVSS score of 8.8/10 and advises updating Endian Firewall to the latest version to remedy the vulnerability.
1000033
1 followersView on X
The Hacker Wire@TheHackerWire188d
Disclosure
🟠 CVE-2026-34796 - High Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to co... https://www.thehackerwire.com/vulnerability/CVE-2026-34796/ https://t.co/oPGLNsR9nw
Post summary
The text announces a newly disclosed vulnerability (CVE-2026-34796) in Endian Firewall, detailing an authenticated remote OS command execution flaw, with no evidence of exploitation or patch details.
0000050
163 followersView on X
CVE@CVEnew189d
Disclosure
CVE-2026-34796 Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE para… https://www.cve.org/CVERecord?id=CVE-2026-34796
Post summary
CVE-2026-34796 is a privilege escalation vulnerability in Endian Firewall versions 3.3.25 and earlier that lets authenticated users execute arbitrary OS commands through the DATE parameter of /cgi-bin/logs_openvpn.cgi.
00000109
56.9K followersView on X
CVEFind.com@CveFindCom189d
Disclosure
[CVE-2026-34796: HIGH] Endian Firewall v3.3.25 and earlier versions are vulnerable to OS command execution by authenticated users via DATE parameter in /cgi-bin/logs_openvpn.cgi, due to incomplete validation...#cve,CVE-2026-34796,#cybersecurity https://cvefind.com/CVE-2026-34796
Post summary
The post reveals a new high‑severity OS command‐execution flaw in Endian Firewall v3.3.25 and earlier, caused by inadequate validation of the DATE parameter in /cgi-bin/logs_openvpn.cgi, but no PoC, exploit, or patch details are provided.
0000045
617 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	endian	firewall_community	-	-	-

Explore more

Back to dashboard endian CVEs firewall_community vulnerabilities

What researchers are saying

CVE-2026-34796

Firmis Labs[verified]@FirmisLabsPatch

The entry points to CVE-2026-34796 with a CVSS score of 8.8/10 and advises updating Endian Firewall to the latest version to remedy the vulnerability.

The Hacker Wire@TheHackerWireDisclosure

The text announces a newly disclosed vulnerability (CVE-2026-34796) in Endian Firewall, detailing an authenticated remote OS command execution flaw, with no evidence of exploitation or patch details.

CVE@CVEnewDisclosure

CVE-2026-34796 is a privilege escalation vulnerability in Endian Firewall versions 3.3.25 and earlier that lets authenticated users execute arbitrary OS commands through the DATE parameter of /cgi-bin/logs_openvpn.cgi.

CVEFind.com@CveFindComDisclosure

The post reveals a new high‑severity OS command‐execution flaw in Endian Firewall v3.3.25 and earlier, caused by inadequate validation of the DATE parameter in /cgi-bin/logs_openvpn.cgi, but no PoC, exploit, or patch details are provided.