PT-2026-3933 · Sangfor · Sangfor Operation/Maintenance Management System

Linxi666 · Publicado 2026-01-22 · Atualizado 2026-01-30 · CVE-2026-1325

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.13

Description A security flaw exists in Sangfor Operation and Maintenance Security Management System. The issue involves the edit pwd mall function within the /fort/login/edit pwd mall file, where manipulation of the flag argument leads to weak password recovery. This allows for remote attacks. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Update Sangfor Operation and Maintenance Security Management System to version 3.0.13 or later. As a temporary workaround, restrict access to the edit pwd mall function. Avoid manipulating the flag argument in the edit pwd mall function.

Exploit

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2026-1325

Produtos afetados

Sangfor Operation/Maintenance Management System

Referências · 9

• 🔥 https://github.com/LX-LX88/cve/issues/21 · Exploit
• https://vuldb.com/?id.342301 · Nota
• https://t.me/cveNotify/150427 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014339298892390507 · Publicação no Twitter
• https://t.me/CVEtracker/42777 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1325 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-1325 · Aviso do Fabricante
• https://vuldb.com/?ctiid.342301 · Nota
• https://vuldb.com/?submit.736208 · Nota