The vulnerability resides in the SessionController component of Sangfor’s Operation and Maintenance Management System, specifically when the keypassword parameter is processed. An attacker can inject arbitrary operating‑system commands, which are executed in the context of the running service. This flaw can be exploited remotely to gain full control of the underlying host, leading to compromise, data theft, or further network exploitation. The CVE description does not specify whether authentication is required; the publicly available proof‑of‑concept demonstrates the potential for remote exploitation but does not confirm credential requirements.

All installations of Sangfor Operation and Maintenance Management System through version 3.0.12 are impacted. The affected component is the SSH Protocol Handler located in the /isomp-protocol/protocol/session file. Users deploying versions before 3.0.13 or any upstream versions that remain unchanged are at risk.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS indicates a very low probability of exploitation (<1%), and the flaw is not yet listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the exploit operates over the network by manipulating the keypassword argument. A publicly available proof‑of‑concept demonstrates the flaw; however, the CVE description does not explicitly state whether authentication is required, so it is unclear if valid credentials are necessary.