جزئیات آسیب‌پذیری
CVE-2026-1324
Sangfor Operation and Maintenance Management System
Sangfor Operation and Maintenance Management System SSH Protocol session SessionController os command injection
CVSS 4.0
8.7بالا
شرح رسمی (انگلیسی)
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.12. Affected by this issue is the function SessionController of the file /isomp-protocol/protocol/session of the component SSH Protocol Handler. The manipulation of the argument keypassword leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.7بالا | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| 8.8بالا | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 8.8بالا | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R |
| 9.0بالا | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Sangfor | Operation and Maintenance Management System | 3.0.0 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.1 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.10 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.11 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.12 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.2 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.3 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.4 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.5 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.6 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.7 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.8 | CVEProject cvelistV5 (CNA) |
| Sangfor | Operation and Maintenance Management System | 3.0.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۴- https://vuldb.com/?id.342300 vdb-entrytechnical-description
- https://vuldb.com/?ctiid.342300 signaturepermissions-required
- https://vuldb.com/?submit.735716 third-party-advisory
- https://github.com/LX-LX88/cve/issues/20 broken-linkexploitissue-tracking
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۱/۰۲
- آخرین به‌روزرسانی
- ۱۴۰۴/۱۲/۰۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- VulDB
پیش‌بینی بهره‌برداری (EPSS)
۶٫۹۸٪
احتمال بهره‌برداری در ۳۰ روز
۹۴٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-78OS Command Injection
- CWE-77Command Injection