This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: OS Command Injection in Sangfor OMS. 💥 **Consequences**: Attackers can execute arbitrary system commands, leading to full server compromise, data theft, or service disruption.
Q2Root Cause? (CWE/Flaw)
🛡️ **Root Cause**: CWE-78. 🐛 **Flaw**: Improper handling of the `sessionPath` parameter in the `/isomp-protocol/protocol/getCmd` endpoint. User input is not sanitized before OS execution.
Q3Who is affected? (Versions/Components)
🏢 **Vendor**: Sangfor (深信服). 📦 **Product**: Operation and Maintenance Management System. 📉 **Affected**: Version 3.0.8 and earlier.
Q4What can hackers do? (Privileges/Data)
👑 **Privileges**: High. CVSS Score indicates Critical impact (C:H, I:H, A:H). 🕵️ **Data**: Full access to underlying OS. Hackers can read/write files, install backdoors, or pivot to internal networks.
Q5Is exploitation threshold high? (Auth/Config)
⚡ **Threshold**: LOW. 🌐 **Access**: Network Accessible (AV:N). 🔑 **Auth**: No Privileges Required (PR:N). 🖱️ **UI**: No User Interaction Needed (UI:N). Easy to exploit remotely.
Q6Is there a public Exp? (PoC/Wild Exploitation)
📢 **Public Exp?**: Yes. 🔗 **Evidence**: GitHub issues and VDB entries confirm exploit availability. ⚠️ **Status**: Active exploitation indicators exist in threat intelligence feeds.
Q7How to self-check? (Features/Scanning)
🔍 **Self-Check**: Scan for Sangfor OSM v3.0.8-. 🎯 **Target**: Check if `/isomp-protocol/protocol/getCmd` is exposed. 🧪 **Test**: Send crafted `sessionPath` payloads to verify command injection response.
Q8Is it fixed officially? (Patch/Mitigation)
🛠️ **Fix**: Upgrade to a patched version > 3.0.8. 📅 **Published**: Advisory released Jan 9, 2026. ✅ **Action**: Apply vendor patch immediately.
Q9What if no patch? (Workaround)
🚧 **Workaround**: If unpatched, block external access to `/isomp-protocol/protocol/getCmd` via WAF or Firewall. 🚫 **Mitigation**: Restrict network access to the management interface strictly.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. With CVSS High/Complete impact and low exploitation barrier, immediate patching or isolation is mandatory to prevent breach.