Executive Summary

CVE-2026-1324 is a critical remote OS command injection vulnerability in Sangfor Operation and Maintenance Management System (up to version 3.0.12). It occurs in the SSH Protocol Handler component, specifically in the SessionController function handling the HTTP POST endpoint `/isomp-protocol/protocol/session`. The vulnerability arises because the application takes the user-supplied `keypassword` parameter and directly concatenates it into a shell command string used in an `ssh-keygen` command without proper sanitization or validation. This allows an attacker to inject arbitrary OS commands remotely by crafting malicious input in the `keypassword` parameter, which the system then executes, potentially compromising the server. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on the server hosting the Sangfor OSM application. This can lead to full compromise of the affected system, including unauthorized access to sensitive data, modification or deletion of files, disruption of services, and potentially using the compromised server as a foothold for further attacks. The impact affects confidentiality, integrity, and availability of the system, making it a critical security risk. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP POST requests to the endpoint `/isomp-protocol/protocol/session` for suspicious payloads in the `keypassword` parameter that may contain command injection patterns such as single quotes, semicolons, or command separators. A practical detection method is to look for unusual files created by injected commands, for example, checking for the presence of files like `/usr/local/tomcat/webapps/isomp-protocol/ssh_hack.txt` which may be created by exploitation attempts. You can use network monitoring tools or web server logs to identify POST requests to this endpoint with suspicious parameters. Additionally, you can use commands like `grep` on server logs to find POST requests containing suspicious `keypassword` values. For example: `grep 'POST /isomp-protocol/protocol/session' /var/log/httpd/access_log | grep keypassword` or monitor for unexpected files created by exploits using `find /usr/local/tomcat/webapps/isomp-protocol/ -name 'ssh_hack.txt'`. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint `/isomp-protocol/protocol/session` by implementing network-level controls such as firewall rules or IP whitelisting to limit access only to trusted users. Since no patches or vendor mitigations are available, disabling or removing the affected Sangfor Operation and Maintenance Management System versions up to 3.0.12 is recommended. Monitoring and blocking suspicious POST requests containing malicious payloads targeting the `keypassword` parameter can help reduce risk. Additionally, consider replacing the affected product with an alternative solution as no known countermeasures or patches exist. [3, 2]

Useful 0 Not Useful 0