This vulnerability allows an unauthenticated remote attacker to perform OS command injection via the Login Endpoint in Sangfor Operation and Maintenance Security Management System up to version 3.0.13. The affected function is com.sbr.fort.foreignDP.DpLoginController in the /fort/portal_login file. Exploitation can lead to execution of arbitrary OS commands on the affected system. The vendor has not issued any fix or advisory, and public exploit details are available.

Successful exploitation of this vulnerability can lead to remote code execution on the affected system, potentially allowing an attacker to execute arbitrary OS commands. This can compromise the confidentiality, integrity, and availability of the system. The vulnerability does not require user interaction or privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level protections such as restricting access to the affected endpoint and monitoring for suspicious activity until an official patch is available.