CVE-2026-34796

HighPublic PoCRCE

Published: 02 April 2026

Published

02 April 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0046 64.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34796 is a high-severity OS Command Injection (CWE-78) vulnerability in Endian Firewall Community. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates command injection by requiring validation of the untrusted DATE parameter before its use in the Perl open() call.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of the insufficient regex validation flaw in /cgi-bin/logs_openvpn.cgi to eliminate the vulnerability.

AC-6 Least Privilege partial match

prevent

Reduces impact of arbitrary command execution by low-privilege authenticated users through enforcement of least privilege.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

The vulnerability is a command injection in a web CGI script (public-facing application exploitation, T1190) enabling arbitrary OS command execution on a Unix-based system (T1059.004: Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which…

allows command injection due to an incomplete regular expression validation.

Deeper analysisAI

CVE-2026-34796 is a command injection vulnerability (CWE-78) in Endian Firewall version 3.3.25 and prior. The flaw resides in the /cgi-bin/logs_openvpn.cgi script, where the DATE parameter is used to build a file path passed directly to a Perl open() call. Insufficient regular expression validation on the parameter enables attackers to inject arbitrary OS commands.

An authenticated user with low privileges (PR:L) can exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants high-impact arbitrary command execution on the underlying OS, potentially compromising confidentiality, integrity, and availability.

Advisories providing mitigation guidance are available from Endian at https://help.endian.com/hc/en-us/sections/360004371358-Community and VulnCheck at https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-logs-openvpn-cgi-date-perl-command-injection.