Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
1328 articles · 102468 vulns · 38/41 feeds (7d)
← Back to list
7.1
CVE-2026-34790EXPLOITED
endian · endian firewall

Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal

Description

A vulnerability was found in Endian Firewall 3.3.25. It has been declared as critical. Affected is the function unlink of the file /cgi-bin/backup.cgi of the component Parameter Handler. Executing a manipulation of the argument Archive can lead to path traversal.

Affected Products

VendorProductVersions
endianendian firewall3.3.25

References

  • https://help.endian.com/hc/en-us/sections/360004371358-Community(release-notes)
  • https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-backup-cgi-remove-archive-directory-traversal(third-party-advisory)

Related News (1 articles)

Tier C
VulDB7h ago
CVE-2026-34790 | Endian Firewall 3.3.25 Parameter /cgi-bin/backup.cgi unlink Archive path traversal
→ No new info (linked only)
CVSS 3.17.1 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CISA KEV❌ No
Actively exploited✅ Yes
CWECWE-22
PublishedApr 2, 2026
Last enriched6h agov2
Trending Score45
Source articles1
Independent1
Info Completeness7/14
Missing: cvss, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-34814EXP
Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting
Trending: 45
HIGHCVE-2026-34796EXP
Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection
Trending: 45
NONECVE-2026-34797EXP
Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection
Trending: 44
NONECVE-2026-34791EXP
Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection
Trending: 44
NONECVE-2026-34793EXP
Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection
Trending: 44

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Apr 2, 2026
Actively Exploited
Apr 2, 2026
Discovered by ZDM
Apr 2, 2026
Updated: severity, activelyExploited, description
Apr 2, 2026

Version History

v2
Last enriched 6h ago
v2Tier C6h ago

Updated severity to CRITICAL, marked as actively exploited, and provided a more detailed description of the vulnerability.

severityactivelyExploiteddescription
via VulDB
v17h ago

Initial creation