CVE-2023-30806: Sangfor NGAF unauthenticated OS command injection via PHPSESSID cookie

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution on an internet-facing security appliance with a critical CVSS score and very high EPSS probability.

What it is

Sangfor Next-Gen Application Firewall version NGAF8.0.17 mishandles shell meta-characters in the PHPSESSID cookie, allowing OS command injection. A remote, unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to /cgi-bin/login.cgi. Because the target is an edge firewall, successful exploitation can compromise a perimeter device.

Impact

An attacker gains arbitrary command execution on the firewall with the privileges of the vulnerable CGI process, enabling full control of the appliance and potential lateral movement into protected networks.

Attack surface

Reachable over the network via HTTP POST to /cgi-bin/login.cgi; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.65799 (99.2nd percentile) and a public exploit write-up is referenced, indicating high likelihood of exploitation.

What to do

• Apply the vendor patch or fixed firmware for Sangfor NGAF8.0.17 as soon as it is available.
• If patching is not immediately possible, restrict access to the management interface and /cgi-bin/login.cgi to trusted management networks only.
• Place the firewall management interface behind a VPN or jump host and block direct internet exposure.
• Monitor vendor advisories and replace or isolate the appliance if no fix is provided.

Detection

• Inspect HTTP requests to /cgi-bin/login.cgi for shell metacharacters (;, |, $(), backticks) in the PHPSESSID cookie.
• Alert on unexpected outbound connections or process execution from the firewall appliance.
• Review firewall and web logs for anomalous POST requests to CGI endpoints from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.