CVE-2025-15502
Published: 10 January 2026
Summary
CVE-2025-15502 is a high-severity Command Injection (CWE-77) vulnerability in Sangfor Operation And Maintenance Security Management System. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of the untrusted Hostname input parameter in the SessionController.
Mandates timely identification, reporting, and remediation of flaws like the command injection vulnerability in Sangfor OMM versions up to 3.0.8.
Facilitates proactive vulnerability scanning to detect and prioritize the publicly exploitable OS command injection in the SessionController.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via Hostname parameter in public-facing web application directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).
NVD Description
A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of the file /isomp-protocol/protocol/session. Such manipulation of the argument Hostname leads to os command injection. The attack can be…
more
executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-15502 is an OS command injection vulnerability affecting Sangfor Operation and Maintenance Management System versions up to 3.0.8. The issue resides in the SessionController function within the file /isomp-protocol/protocol/session, where manipulation of the Hostname argument enables command injection. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers without authentication or privileges can exploit this vulnerability by sending crafted requests that inject malicious OS commands via the Hostname parameter. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling arbitrary command execution on the affected system.
Advisories from VulDB and GitHub detail the vulnerability, noting that a public exploit is available and may be actively used. The vendor was notified early but has not responded or issued patches, leaving no official mitigations documented in the provided references.
Details
- CWE(s)