10.0Critical
CVE-2025-34041Sangfor Endpoint Detection and Response OS Command Injection
Description
An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chinese-language EDR builds. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Sangfor Technologies Co., Ltd. | Endpoint Detection and Response Platform | 3.2.16, 3.2.17, 3.2.19 | |
| symantec | endpoint detection and response | 3.2.16 |
References and patches
- https://www.sangfor.com/blog/cybersecurity/sangfor-endpoint-secure-remote-command-execution-vulnerability vendor-advisorypatchtechnical-description
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-46552 third-party-advisory
- https://vulncheck.com/advisories/sangfor-edr-command-injection third-party-advisory