CVE-2026-1412: Sangfor Operation and Maintenance Security Management

Описание

Оригинално описание

A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12. The impacted element is an unknown function of the file /fort/audit/get_clip_img of the component HTTP POST Request Handler. Such manipulation of the argument frame/dirno leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Засегнати продукти

• Sangfor Operation and Maintenance Security Management System: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; 3.0.12

Вид слабост

• CWE-77 Инжектиране на команди
• CWE-74 Неправилна неутрализация на специални елементи в изходни данни

История

Други уязвимости в Sangfor Operation and Maintenance Security Management System

• 7.3CVE-2026-18641
• 6.3CVE-2026-1414
• 6.3CVE-2026-1413
• 6.9CVE-2026-1325
• 6.3CVE-2025-12916

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-1412
• https://nvd.nist.gov/vuln/detail/CVE-2026-1412
• https://vuldb.com/?id.342801
• https://vuldb.com/?ctiid.342801
• https://vuldb.com/?submit.736513
• https://github.com/LX-LX88/cve/issues/22