CVE-2025-15502: Sangfor Operation and Maintenance Management System session SessionController os command injection
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of the file /isomp-protocol/protocol/session. Such manipulation of the argument Hostname leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15502?
CVE-2025-15502 is considered a high-severity vulnerability due to its potential for remote code execution via OS command injection.
How do I fix CVE-2025-15502?
To fix CVE-2025-15502, upgrade the Sangfor Operation and Maintenance Management System to version 3.0.9 or later.
What systems are affected by CVE-2025-15502?
CVE-2025-15502 affects the Sangfor Operation and Maintenance Management System up to version 3.0.8.
What type of vulnerability is CVE-2025-15502?
CVE-2025-15502 is an OS command injection vulnerability that allows attackers to execute arbitrary commands on the host system.
Can CVE-2025-15502 be exploited remotely?
Yes, CVE-2025-15502 can be exploited remotely if the vulnerable system is exposed to the internet.