CVE-2023-30805: Sangfor NGAF unauthenticated OS command injection in login endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityPre-auth remote command execution on an internet-facing security appliance with a 9.8 CVSS score and high EPSS probability.

What it is

Sangfor Next-Gen Application Firewall 8.0.17 mishandles shell metacharacters in the "un" parameter of the /LogInOut.php endpoint, allowing OS command injection. Because the endpoint is reachable without authentication, this is a pre-auth remote code execution flaw in an internet-facing security appliance.

Impact

An attacker can execute arbitrary operating system commands on the firewall, gaining full control of the device with high confidentiality, integrity and availability impact. Compromise of a perimeter firewall can expose or disrupt the network it protects.

Attack surface

Reached over the network via a crafted HTTP POST to /LogInOut.php; the CVSS vector indicates no privileges and no user interaction are required. The endpoint is part of the appliance's login handling, so it is expected to be exposed to management or internet traffic.

Exploitation

Not listed in CISA KEV, but EPSS is 0.65799 (99.2nd percentile) and a public third-party write-up is tagged as an exploit, indicating public exploit material exists. No ransomware group usage is documented in the record.

What to do

• Apply the vendor patch or fixed firmware for Sangfor NGAF; confirm the exact fixed version with Sangfor since the record does not state one.
• Restrict access to the NGAF management/login interface to trusted networks and block /LogInOut.php from untrusted sources.
• Place the appliance behind access controls or a VPN so the login endpoint is not reachable from the internet.
• Monitor vendor advisories and the referenced WatchTowr and VulnCheck write-ups for updated guidance.
• If patching is delayed, consider isolating or replacing the exposed appliance given pre-auth RCE risk.

Detection

• Inspect HTTP POST requests to /LogInOut.php for shell metacharacters or command syntax in the "un" parameter.
• Alert on unexpected child processes or shell execution spawned by the firewall's web service.
• Review firewall and web logs for anomalous POSTs to login endpoints from untrusted source IPs.
• Hunt for outbound connections or command-and-control traffic originating from the NGAF appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.