A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.
References
| Link | Resource |
|---|---|
| https://h4cker.zip/post/fe0ada/ | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.331634 | Permissions Required VDB Entry |
| https://vuldb.com/?id.331634 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.678377 | Third Party Advisory VDB Entry |
| https://h4cker.zip/post/fe0ada/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Dec 2025, 21:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sangfor
Sangfor operation And Maintenance Security Management System |
|
| CPE | cpe:2.3:a:sangfor:operation_and_maintenance_security_management_system:*:*:*:*:*:*:*:* | |
| References | () https://h4cker.zip/post/fe0ada/ - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.331634 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.331634 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.678377 - Third Party Advisory, VDB Entry |
13 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://h4cker.zip/post/fe0ada/ - |
09 Nov 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-09 00:15
Updated : 2025-12-09 21:48
NVD link : CVE-2025-12916
Mitre link : CVE-2025-12916
CVE.ORG link : CVE-2025-12916
JSON object : View
Products Affected
sangfor
- operation_and_maintenance_security_management_system