A critical OS command injection vulnerability in the Sangfor Operation and Maintenance Management System allows unauthenticated remote attackers to execute arbitrary system commands.

This is an OS command injection flaw (CWE-78) located in the SessionController function within the /isomp-protocol/protocol/session file. An unauthenticated attacker can trigger the vulnerability by manipulating the Hostname argument to execute unauthorized commands on the underlying operating system.

The ability for an unauthenticated remote attacker to execute arbitrary OS commands poses a severe threat to system confidentiality, integrity, and availability. With a CVSS score of 7.3, this vulnerability could lead to total system compromise, unauthorized data exfiltration, or the deployment of persistent malware. Organizations relying on this system for management tasks face significant operational disruption and potential lateral movement risks if the appliance is compromised.

Immediate Action: Since no official patch is currently available from the vendor, restrict network access to the management interface to trusted IP addresses only and block all external requests to the affected endpoint.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns, unexpected outbound network connections from the management server, or anomalous traffic directed at the /isomp-protocol/protocol/session endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to inspect and filter the Hostname parameter within the specified session URI to prevent malicious command injection strings from reaching the backend application.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced security research.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Security teams must prioritize isolating the management interface from untrusted networks and implementing strict WAF filtering until the vendor releases a security update. Continuous vigilance is required until an official patch is applied to neutralize the underlying injection flaw.