CVE-2026-1414 - Vulnerability Details

- Sangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection

Description

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Published: 2026-01-26

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An attacker can exploit a command injection flaw in the getInformation function of the HTTP POST handler by manipulating the fortEquipmentIp argument. The flaw allows execution of arbitrary system commands on the underlying server, leading to full compromise of confidentiality, integrity, and availability of the affected device.

Affected Systems

Sangfor Operation and Maintenance Security Management System versions up to and including 3.0.12 are impacted. No specific service pack or build identifiers are listed beyond the major version boundary.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate risk, but the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not currently recorded in the CISA KEV catalog. An attacker can launch the exploit remotely via an HTTP POST request to /equipment/get_Information, making the attack straightforward for anyone with network access to the system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Sangfor

Operation and Maintenance Security Management System

affected

Version	Status	Constraints
`3.0.0`	affected	—
`3.0.1`	affected	—
`3.0.2`	affected	—
`3.0.3`	affected	—
`3.0.4`	affected	—
`3.0.5`	affected	—
`3.0.6`	affected	—
`3.0.7`	affected	—
`3.0.8`	affected	—
`3.0.9`	affected	—
`3.0.10`	affected	—
`3.0.11`	affected	—
`3.0.12`	affected	—

Configuration 1 [-]

cpe:2.3:a:sangfor:operation_and_maintenance_security_management_system:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Sangfor	Operation And Maintenance Security Management System	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Sangfor Operation and Maintenance Security Management System to any version newer than 3.0.12 where the command injection bug has been fixed.
Restrict network access to the /equipment/get_Information endpoint, for example by limiting the IP range or enforcing strict authentication before allowing POST requests.
Implement server-side input validation and sanitization for the fortEquipmentIp parameter to eliminate potential command injection vectors.

Generated by OpenCVE AI on April 18, 2026 at 02:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00103.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/LX-LX88/cve/issues/24
https://vuldb.com/?ctiid.342803
https://vuldb.com/?id.342803
https://vuldb.com/?submit.736524

History

Fri, 30 Jan 2026 17:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:sangfor:operation_and_maintenance_security_management_system::::::::

Mon, 26 Jan 2026 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 26 Jan 2026 12:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sangfor Sangfor operation And Maintenance Security Management System
Vendors & Products		Sangfor Sangfor operation And Maintenance Security Management System

Mon, 26 Jan 2026 03:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Title		Sangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/LX-LX88/cve/issues/24 https://vuldb.com/?ctiid.342803 https://vuldb.com/?id.342803 https://vuldb.com/?submit.736524
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Sangfor Operation And Maintenance Security Management System

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-01-26T02:02:06.549Z

Updated: 2026-02-23T08:55:31.161Z

Reserved: 2026-01-25T09:50:43.788Z

Link: CVE-2026-1414

Vulnrichment

Updated: 2026-01-26T17:27:03.090Z

NVD

Status : Analyzed

Published: 2026-01-26T03:15:49.587

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1414

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T03:00:10Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object