A critical OS command injection vulnerability in the Sangfor Operation and Maintenance Management System allows remote attackers to execute arbitrary system commands.

The vulnerability exists within the SessionController function of the SSH Protocol Handler, where the keypassword argument fails to sanitize user input, leading to OS command injection. While the CVSS vector indicates low privileges are required, the flaw is remotely exploitable and allows for full system compromise.

The ability for an attacker to execute arbitrary OS commands poses a severe risk to organizational security, potentially resulting in full system takeover, data exfiltration, or lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to significant operational disruption and total loss of confidentiality, integrity, and availability of the affected management system.

Immediate Action: As no official patch is currently identified, restrict network access to the management interface to trusted internal segments only and monitor for unauthorized access attempts.

Proactive Monitoring: Inspect system logs for suspicious process execution patterns or unexpected shell commands originating from the /isomp-protocol/protocol/session endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) to detect and block malicious payloads containing command injection strings targeted at the keypassword parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/LX-LX88/cve/issues/20.

Given the availability of a public proof-of-concept and the high severity of the vulnerability, organizations must treat this as a priority. If the vendor does not provide a security update, consider isolating the affected system from all external networks to prevent remote exploitation. Organizations should remain vigilant for official vendor communication and apply the necessary updates immediately upon release.