PT-2026-1778 · Sangfor · Sangfor Operation/Maintenance Management System

Nestor233 · Published 2026-01-09 · Updated 2026-01-10 · CVE-2025-15501

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Management System versions up to 3.0.8

Description A flaw exists in Sangfor Operation and Maintenance Management System. Manipulation of the sessionPath argument within the WriterHandle.getCmd function, located in the file /isomp-protocol/protocol/getCmd, can lead to operating system command injection. Remote exploitation is possible. The exploit for this issue has been publicly disclosed. The vendor was informed of this issue but did not provide a response.

Recommendations Versions up to 3.0.8 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-15501

Affected Products

Sangfor Operation/Maintenance Management System

References · 14

• 🔥 https://github.com/master-abc/cve/issues/12#issue-3770615262 · Exploit
• 🔥 https://github.com/master-abc/cve/issues/12 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15501 · Security Note
• https://t.me/CVEtracker/41885 · Telegram Post
• https://vuldb.com/?submit.727214 · Note
• https://vuldb.com/?ctiid.340346 · Note
• https://twitter.com/0dayPublishing/status/2009757311661674574 · Twitter Post
• https://twitter.com/CveFindCom/status/2009771937057112264 · Twitter Post
• https://vuldb.com/?id.340346 · Note
• https://twitter.com/CVEnew/status/2009757349691490571 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009830880861139315 · Twitter Post
• https://t.me/cveNotify/148318 · Telegram Post
• https://twitter.com/TheHackerWire/status/2009767381028233361 · Twitter Post