The vulnerability arises from an OS command injection flaw in the Login Endpoint's DpLoginController, allowing attackers to inject and execute arbitrary operating‑system commands when accessing the /fort/portal_login path. This is recognized as CWE‑77 and CWE‑78. When exploited remotely, an attacker can compromise confidentiality by accessing sensitive data, alter integrity by modifying configuration or files, and cause denial of service through system crashes or resource exhaustion.

Affected product is Sangfor Operation and Maintenance Security Management System, versions up to 3.0.13 inclusive. The vulnerability is present in the component handling the portal_login endpoint and is limited to those releases; later versions are expected to contain fixes.

The CVSS base score of 6.9 denotes moderate severity, and the EPSS score of 2% indicates a low but non‑zero likelihood of exploitation. The publicly disclosed exploit demonstrates that attackers can use this vulnerability remotely via the /fort/portal_login endpoint. As the vendor has not yet released a patch, exposed systems remain at significant risk.