A vulnerability in the Sangfor Operation and Maintenance Security Management System allows an attacker to manipulate the flag parameter in the edit_pwd_mall endpoint, resulting in a weak password recovery mechanism. The flaw is exploitable remotely and has an associated public exploit. If successfully leveraged, an attacker could reset a user’s password without proper authorization, potentially compromising any accounts that rely on that password.

Sangfor Operation and Maintenance Security Management System versions up to and including 3.0.12 are affected.

The CVSS score of 6.9 indicates a medium severity, with an EPSS score of less than 1% suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only remote access to the vulnerable endpoint and manipulation of the flag argument, and the public exploit releases have demonstrated the feasibility of the attack in practice.