CVE-2025-15502 is a high severity OS command injection (CVSS 7.3) in Sangfor Operation and Maintenance Management System up to 3.0.8. The Hostname argument handled by SessionController at /isomp-protocol/protocol/session reaches a command unsafely. The vendor did not respond and no fix is confirmed.
What's affected
The record lists the Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController at the path /isomp-protocol/protocol/session, and the input is the Hostname argument. Unlike its sibling CVE-2025-15499, the CVSS vector for this one needs no privileges, so it can be reached before login.
The record says the exploit is public and the vendor did not respond. No fixed version is named. The third report from the same disclosure is CVE-2025-15503.
A session endpoint that takes a hostname suggests a feature that opens connections to managed servers. That is the kind of place where values reach a shell when developers shell out to common tools.
How to check if you're exposed
Check these items:
- Find any Sangfor operation and maintenance appliance in your asset list and note its version.
- Test whether the
/isomp-protocol/path is reachable from outside your admin network. If an external probe gets any answer, restrict it immediately. - In web logs, search for requests to the session path with host values that include shell characters, spaces or long strings:
grep "isomp-protocol/protocol/session" access.log
- On the host, check for unexpected child processes of the web service and new outbound connections.
If you do not run this product, no action is needed on your own systems.
What to do now
- Confirm whether Sangfor Operation and Maintenance Management System 3.0.8 or earlier is deployed.
- Block the
/isomp-protocol/path from untrusted networks at the firewall or reverse proxy. - Put the management interface on a protected admin network and remove public exposure.
- Review the host and the credentials it stores for signs of misuse since the public disclosure.
- Request patch status from the vendor and record it.
Why it matters
The record lists CWE-78, OS Command Injection, and CWE-77, Command Injection. Handling a hostname value correctly means validating it as a hostname and passing it as an argument rather than through a shell. When a string reaches a shell, characters like semicolons and ampersands turn data into extra commands.
The vector is network based with no privileges (7.3), so exposure to the internet is the dominant risk factor. It is not in CISA's Known Exploited Vulnerabilities catalog per the record.
Quick check
Does this one need a login?
Per the CVSS vector it needs no privileges, unlike CVE-2025-15499, which needs a low privilege account.
What is the first control to apply?
Remove internet exposure of the management interface and block the session path from untrusted networks.
Sources
Last reviewed: 19 October 2026.
