PT-2026-3933 · Sangfor · Sangfor Operation/Maintenance Management System

Linxi666 · Published 2026-01-22 · Updated 2026-01-30 · CVE-2026-1325

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.13

Description A security flaw exists in Sangfor Operation and Maintenance Security Management System. The issue involves the edit pwd mall function within the /fort/login/edit pwd mall file, where manipulation of the flag argument leads to weak password recovery. This allows for remote attacks. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Update Sangfor Operation and Maintenance Security Management System to version 3.0.13 or later. As a temporary workaround, restrict access to the edit pwd mall function. Avoid manipulating the flag argument in the edit pwd mall function.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-1325

Affected Products

Sangfor Operation/Maintenance Management System

References · 9

• 🔥 https://github.com/LX-LX88/cve/issues/21 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1325 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1325 · Vendor Advisory
• https://vuldb.com/?id.342301 · Note
• https://t.me/cveNotify/150427 · Telegram Post
• https://twitter.com/CVEnew/status/2014339298892390507 · Twitter Post
• https://t.me/CVEtracker/42777 · Telegram Post
• https://vuldb.com/?ctiid.342301 · Note
• https://vuldb.com/?submit.736208 · Note