EUVD-2026-52416
GHSA-x8c2-xf69-cq6v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable OS command injection warrants full C/I/A impact; provided VC/VI/VA:L appears conservatively scored for this vulnerability class.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in Sangfor Fort (Operation and Maintenance Security Management System) up to version 3.0.13 allows remote, unauthenticated attackers to execute arbitrary OS commands via a crafted request to the login endpoint /fort/portal_login. The flaw resides in the DpLoginController Java class and requires no authentication, making it trivially reachable across any network path to the appliance. A public proof-of-concept exploit exists; the vendor did not respond to coordinated disclosure, and no patch has been released at time of analysis.
Technical ContextAI
The vulnerability is a classic OS command injection (CWE-77: Improper Neutralization of Special Elements used in a Command), meaning user-supplied input reaches a system-level command execution function without sufficient sanitization or escaping. The affected component is com.sbr.fort.foreignDP.DpLoginController - a Java class handling the unauthenticated portal login flow at the /fort/portal_login HTTP endpoint. 'Fort' is Sangfor's bastion-host and privileged-access management platform used for auditing and brokering connections to downstream infrastructure. Because the flaw is in the login controller (pre-authentication), no session token or credential is required to trigger it. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully network-accessible, low-complexity exploitation with no interaction or special attack preconditions.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and no fixed version is referenced in any available source. Immediate compensating controls should be applied: restrict network access to the /fort/portal_login endpoint at the perimeter firewall or load balancer to only trusted IP ranges (internal SOC/admin subnets), as the attack vector is fully network-based; deploy a Web Application Firewall (WAF) rule to detect and block OS command injection payloads (shell metacharacters, pipe operators, backtick sequences) in HTTP parameters sent to /fort/portal_login - note this may cause false positives if legitimate logins use special characters. If the Fort appliance is internet-exposed, move it behind VPN immediately; this single change eliminates the unauthenticated remote attack surface. Monitor the system for anomalous child process spawning from the web application process (e.g., bash, sh, curl, wget spawned by the Java process). Track https://vuldb.com/vuln/385562 and https://github.com/lkua-1/cve/issues/1 for vendor response or community patches.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today