CVE-2025-15500

CRITICAL WAF: High
CVSS 9.8 Published: 2026-01-09
CWE-77 CWE-78 CWE-78

A vulnerability was found in Sangfor Operation and Maintenance Management System up to 3.0.8. This issue affects some unknown processing of the file /isomp-protocol/protocol/getHis of the component HTTP POST Request Handler. The manipulation of the argument sessionPath results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

WAF Coverage Analysis

Command Injection High WAF Coverage

OWASP: A03:2021 Injection

932xxx - Remote Code Execution
OS Command Injection High WAF Coverage

OWASP: A03:2021 Injection

932xxx - Remote Code Execution
OS Command Injection High WAF Coverage

OWASP: A03:2021 Injection

932xxx - Remote Code Execution

Affected Software

VendorProductVersion
sangforoperation_and_maintenance_management_systemup to 3.0.8

References

  • github.com (Exploit, Issue Tracking, Third Party Advisory)
  • github.com (Exploit, Issue Tracking, Third Party Advisory)
  • vuldb.com (Permissions Required, VDB Entry)
  • vuldb.com (Third Party Advisory, VDB Entry)
  • vuldb.com (Third Party Advisory, VDB Entry)
Back to CVE Database