Vulnerability · Published Nov 8, 2025 · Assigned by VulDB
CVE-2025-12916Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection
Medium 6.3
In plain English
A medium-severity command injection in Operation and Maintenance Security Management System from Sangfor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sangfor | Operation and Maintenance Security Management System | 3.0 |
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-331634 | Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection vdb-entry, technical-description
- VDB-331634 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #678377 | Sangfor Sangfor Operation and Maintenance Security Management System ≥3.0 Command Injection third-party-advisory
- https://h4cker.zip/post/fe0ada/ exploit