Endian Firewall Command Injection Vulnerability in Logs Management CGI

A command injection vulnerability has been identified in Endian Firewall versions through 3.3.25. This issue allows authenticated users to execute arbitrary operating system commands by manipulating the DATE parameter in the /cgi-bin/logs_ids.cgi script. The vulnerability arises from inadequate regular expression validation, which enables the crafted parameter value to be used in a file path that is passed to a Perl open() function call, leading to unauthorized command execution.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the firewall.