CVE-2025-15499
Published: 09 January 2026
Summary
CVE-2025-15499 is a high-severity Command Injection (CWE-77) vulnerability in Sangfor Operation And Maintenance Management System. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating the manipulated filename argument in the uploadCN function.
Requires identification, reporting, and correction of the specific flaw enabling command injection in VersionController.java.
Limits damage from low-privileged exploitation by enforcing least privilege on accounts and processes executing injected commands.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (T1190) via authenticated command injection in a Java controller, directly facilitating arbitrary OS command execution likely via Unix Shell (T1059.004).
NVD Description
A vulnerability has been found in Sangfor Operation and Maintenance Management System up to 3.0.8. This vulnerability affects the function uploadCN of the file VersionController.java. The manipulation of the argument filename leads to os command injection. The attack may be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-15499 is an OS command injection vulnerability affecting the Sangfor Operation and Maintenance Management System in versions up to 3.0.8. The issue resides in the uploadCN function of the VersionController.java file, where manipulation of the filename argument enables command injection. It is classified under CWE-77 and CWE-78, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability allows remote exploitation by low-privileged authenticated users, requiring no user interaction and low attack complexity. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially executing arbitrary operating system commands on the affected system.
Advisories from VulDB and related GitHub issues indicate that the vendor was contacted early about the disclosure but provided no response. No patches or specific mitigations are detailed in the available references. The exploit has been publicly disclosed and may be used by attackers.
In notable context, the vulnerability was published on 2026-01-09, and the public exploit availability increases the risk of active exploitation against unpatched Sangfor OMM systems.
Details
- CWE(s)