CVE-2026-1414: Sangfor Operation and Maintenance Security Management

Описание

Оригинално описание

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This impacts the function getInformation of the file /equipment/get_Information of the component HTTP POST Request Handler. Executing a manipulation of the argument fortEquipmentIp can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Засегнати продукти

• Sangfor Operation and Maintenance Security Management System: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; 3.0.7; 3.0.8; 3.0.9; 3.0.10; 3.0.11; 3.0.12

Вид слабост

• CWE-77 Инжектиране на команди
• CWE-74 Неправилна неутрализация на специални елементи в изходни данни

История

Други уязвимости в Sangfor Operation and Maintenance Security Management System

• 7.3CVE-2026-18641
• 6.3CVE-2026-1413
• 7.3CVE-2026-1412
• 6.9CVE-2026-1325
• 6.3CVE-2025-12916

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-1414
• https://nvd.nist.gov/vuln/detail/CVE-2026-1414
• https://vuldb.com/?id.342803
• https://vuldb.com/?ctiid.342803
• https://vuldb.com/?submit.736524
• https://github.com/LX-LX88/cve/issues/24