CVE-2026-1412 is a high severity command injection (CVSS 7.3) in the Sangfor Operation and Maintenance Security Management System up to 3.0.12. The frame or dirno argument of the get_clip_img handler reaches a command. The vendor did not respond to the disclosure, so restrict access and ask Sangfor for a fix.
What's affected
The record says versions up to 3.0.12 of the Sangfor Operation and Maintenance Security Management System are affected. The affected file is /fort/audit/get_clip_img, in the HTTP POST request handler, and the arguments involved are frame and dirno.
The record states that the vendor was contacted early and did not respond. We found no vendor advisory or fixed version, so none is named here. Ask Sangfor for guidance on your deployment.
How to check if you're exposed
Check the version shown in the admin interface. If it is 3.0.12 or older, treat it as affected. Then check where the web interface is reachable from, since the record says the attack can start remotely.
Look in the web server and application logs for unusual requests to the path named above, and watch the host for unexpected child processes.
What to do now
- Confirm the version and where the management interface is reachable from.
- Restrict access to a small admin network or VPN.
- Review accounts and remove ones that are not needed, since a login is required.
- Ask Sangfor for a fixed build or mitigation and keep the reply on file.
- Watch the host for unexpected processes and outbound connections.
Why it matters
The input is not separated from the command that uses it. The record lists CWE-74 and CWE-77, injection and command injection, and says the issue is in an HTTP POST handler on an audit path. The vector shows no login needed and low impact ratings for each of confidentiality, integrity and availability, which gives the 7.3 score.
A low rated command injection can still give a foothold on a system that manages privileged access, so do not let the number set the priority alone. The record says an exploit has been disclosed and may be used. It does not flag the CVE as known exploited.
The record lists these weakness classes: CWE-74 (Injection), CWE-77 (Command Injection).
Quick check
Does the attacker need to log in?
The record vector shows no privileges required, and says the attack can be launched remotely.
Sources
Last reviewed: 19 October 2026.
