Vulnerability · Published Jun 24, 2025 · Assigned by VulnCheck
CVE-2025-34041Sangfor Endpoint Detection and Response OS Command Injection
Critical 10.0
In plain English
A critical-severity OS command injection in Endpoint Detection and Response Platform from Sangfor Technologies Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 95% of all known vulnerabilities).
Official description
An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chinese-language EDR builds. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sangfor Technologies Co., Ltd. | Endpoint Detection and Response Platform | 3.2.163.2.173.2.19 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://www.sangfor.com/blog/cybersecurity/sangfor-endpoint-secure-remote-command-execution-vulnerability vendor-advisory, patch, technical-description
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-46552 third-party-advisory
- https://vulncheck.com/advisories/sangfor-edr-command-injection third-party-advisory