CVE-2025-12916

MEDIUM

Sangfor Operation And Maintenance Security Management System < 3.0.11 - Command Injection

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-12916. PoCs published by Jinxia62.

AI-analyzed exploit summary This repository contains a Python-based scanner for detecting CVE-2025-12916, a remote command execution vulnerability in Sangfor OSM systems. The tool tests multiple payloads to identify vulnerable targets and categorizes results based on response patterns.

Description

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.

Exploits (1)

nomisec SCANNER 4 stars
by Jinxia62 · poc
https://github.com/Jinxia62/Sangfor-CVE-2025-12916

This repository contains a Python-based scanner for detecting CVE-2025-12916, a remote command execution vulnerability in Sangfor OSM systems. The tool tests multiple payloads to identify vulnerable targets and categorizes results based on response patterns.

Classification
Scanner 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Sangfor OSM (运维安全管理系统)
No auth needed
Prerequisites: Network access to target system · Target system running vulnerable Sangfor OSM version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.331634
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.331634
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.678377
Exploit, Third Party Advisory exploit
https://h4cker.zip/post/fe0ada/

Scores

CVSS v3 6.3
EPSS 0.0460
EPSS Percentile 90.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
sangfor/operation_and_maintenance_security_management_system 3.0 - 3.0.11
Published Nov 09, 2025
Tracked Since Feb 18, 2026