The vulnerability resides in a parameter handling flaw within the portValidate function of the Sangfor Operation and Maintenance Security Management System. A crafted HTTP POST request with an unvalidated "port" argument enables command injection, allowing an attacker to execute arbitrary commands on the underlying system. This can compromise confidentiality, integrity, and availability of the affected host by providing attackers with the same privileges the web service runs under. The flaw is identified as CWE-74 and CWE-77, indicating improper input validation and unsafe execution of OS commands.

Sangfor Operation and Maintenance Security Management System versions up to and including 3.0.12 are affected. The vulnerability is present in the HTTP POST request handler for the /fort/ip_and_port/port_validate endpoint. No other versions or product lines are listed as affected.

The CVSS score of 5.3 reflects a moderate severity. An EPSS score of less than 1% suggests that, so far, exploitation attempts are rare, but a public exploit exists, implying that the vulnerability is actively available for use. The defect can be activated remotely by sending a specially crafted POST request to the portValidate endpoint. No authentication requirement is mentioned, so network access to the server is the primary prerequisite. The vulnerability is not cataloged in CISA’s KEV list, but its public exploit and command‑execution potential warrant immediate attention.