CVE-2026-1413
BaseFortify
Publication date: 2026-01-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangfor | operation_and_maintenance_security_management_system | to 3.0.12 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1413 is a critical remote command injection vulnerability in Sangfor's Operation and Maintenance Security Management System (OSM) up to version 3.0.12. It affects the portValidate function accessed via an HTTP POST request. The vulnerability arises because the 'port' parameter is not properly validated or sanitized, allowing attackers to inject arbitrary shell commands using command separators like ';' or '|'. These commands are executed on the server through a shell executor, enabling remote code execution without authentication. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the server hosting the Sangfor OSM system. This can lead to full compromise of the system's confidentiality, integrity, and availability. Attackers could run malicious commands, potentially gaining control over the server, accessing sensitive data, disrupting services, or deploying further attacks within the network. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by identifying systems running Sangfor Operation and Maintenance Security Management System (OSM) up to version 3.0.12 that expose the vulnerable HTTP POST endpoint `/fort/ip_and_port/port_validate`. A FOFA query to find affected systems is: `body="/fort/login" && product="SANGFOR-运维安全管理系统"`. To test for exploitation, you can send a crafted HTTP POST request to the endpoint with a malicious `port` parameter containing shell command separators such as `;` or `|`. For example, using curl: `curl -X POST -d "ip=8.8.8.8&port=80; id > /usr/local/tomcat/webapps/fort/trust/js/so_666.txt;" http://target/fort/ip_and_port/port_validate`. If the command executes and creates the file, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict input validation on the `port` parameter to allow only numeric values within the valid port range (1-65535), for example using a regex like `^\d{1,5}$`. Avoid using `Runtime.exec()` with concatenated command strings; instead, use safer methods such as `ProcessBuilder` with argument lists to prevent command injection. If possible, update or patch the affected Sangfor OSM system to a version that fixes this vulnerability or replace the product. Additionally, monitor and restrict access to the vulnerable endpoint and review logs for suspicious activity. [1]