PT-2026-3933 · Sangfor · Sangfor Operation/Maintenance Management System

Linxi666 · Published 2026-01-22 · Updated 2026-01-30 · CVE-2026-1325

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.13

Description A security flaw exists in Sangfor Operation and Maintenance Security Management System. The issue involves the

edit pwd mall

function within the

/fort/login/edit pwd mall

file, where manipulation of the

flag

argument leads to weak password recovery. This allows for remote attacks. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Update Sangfor Operation and Maintenance Security Management System to version 3.0.13 or later. As a temporary workaround, restrict access to the

edit pwd mall

function. Avoid manipulating the

flag

argument in the

edit pwd mall

function.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-1325

Affected Products

Sangfor Operation/Maintenance Management System

References · 8

• 🔥 https://github.com/LX-LX88/cve/issues/21 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1325 · Security Note
• https://t.me/CVEtracker/42777 · Telegram Post
• https://t.me/cveNotify/150427 · Telegram Post
• https://twitter.com/CVEnew/status/2014339298892390507 · Twitter Post
• https://vuldb.com/?submit.736208 · Note
• https://vuldb.com/?ctiid.342301 · Note
• https://vuldb.com/?id.342301 · Note