CVE-2025-12916

MediumCVSS 6.3

Published: 09/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.06%

92th percentile - higher than 92% of all known CVEs

Summary

A vulnerability was found in Sangfor Operation and Maintenance Security Management System version 3.0 in an unknown function of /fort/portal_login in the Frontend component. Manipulating the loginUrl argument leads to command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

Risk Assessment

A remote attacker can execute arbitrary commands on the system, potentially compromising the security management platform. The public availability of the exploit increases the attack risk.

Recommendation

Upgrade the system to version 3.0.11 or 3.0.12, which fix this vulnerability. Until upgraded, restrict access to the vulnerable interface.

Other vulnerabilities in Sangfor Operation and Maintenance Security Management System

CVE-2026-18641High
Sangfor Operation and Maintenance Security Management System up to version 3.0.13 contains an OS command injection vulnerability in the DpLoginController function. The attack can be performed remotely and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS