CVE-2026-1413 is a medium severity command injection (CVSS 6.3) in the Sangfor Operation and Maintenance Security Management System up to 3.0.12. The port argument of portValidate reaches a command. A low privilege login is needed. The vendor did not respond to the disclosure, so restrict access and ask for a fix.
What's affected
The record says versions up to 3.0.12 of the Sangfor Operation and Maintenance Security Management System are affected. The affected function is portValidate in /fort/ip_and_port/port_validate, in the HTTP POST request handler, and the argument involved is port.
The record states that the vendor was contacted early and did not respond. We found no vendor advisory or fixed version, so none is named here. Ask Sangfor for guidance on your deployment.
How to check if you're exposed
Check the version shown in the admin interface. If it is 3.0.12 or older, treat it as affected. Then check where the web interface is reachable from, since the record says the attack can start remotely.
Look in the web server and application logs for unusual requests to the path named above, and watch the host for unexpected child processes.
What to do now
- Confirm the version and where the management interface is reachable from.
- Restrict access to a small admin network or VPN.
- Review accounts and remove ones that are not needed, since a login is required.
- Ask Sangfor for a fixed build or mitigation and keep the reply on file.
- Watch the host for unexpected processes and outbound connections.
Why it matters
Command injection means attacker controlled text ends up in a command the server runs. The record lists CWE-74 and CWE-77. Here the vector requires a low privilege account, which is why the score is 6.3 rather than higher.
That requirement helps only if your user list is tight. On a privileged access system, review who has an account. The record says the exploit has been made public and could be used. It does not flag the CVE as known exploited.
The record lists these weakness classes: CWE-74 (Injection), CWE-77 (Command Injection).
Quick check
Why a medium score?
The vector needs a low privilege login and rates impact as low across the board. Context still matters, because the product guards privileged access.
Sources
Last reviewed: 19 October 2026.
