This vulnerability in Sangfor Operation and Maintenance Security Management System up to version 3.0.13 allows remote attackers to perform OS command injection via the Login Endpoint's com.sbr.fort.foreignDP.DpLoginController function. The flaw exists in the /fort/portal_login component, enabling attackers to manipulate input to execute arbitrary operating system commands. The vendor was notified but has not issued a response or fix. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability can lead to remote execution of arbitrary OS commands on the affected system, potentially compromising system integrity and confidentiality. The vulnerability requires no privileges or user interaction to exploit and can be triggered remotely. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, suggesting some constraints or mitigations may exist in practice.

No official patch or remediation has been provided by the vendor as of the publication date. Users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected login endpoint and applying network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.