CVE-2023-30804: Sangfor Net-Gen Application Firewall · Information Exposure
Affects Sangfor Net-Gen Application FirewallSource CVE Database V5
Mentioned vulnerabilities
Not known to be exploited · 38% EPSS · CVSS 4.9 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 38.9% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Oct 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Sangfor Net-Gen Application Firewall | Affected
| Fixed in– |
AI-suggested
- Monitor Sangfor’s official channels for patches addressing CVE-2023-30804 and CVE-2023-30803 and apply updates promptly once available.
- Restrict access to the management interfaces and the svpn_html/loadfile.php endpoint using network segmentation, firewall rules, or VPN access controls to limit exposure to trusted administrators only.
- Implement strong authentication mechanisms and enforce least privilege principles to reduce the risk of credential compromise.
- Conduct regular audits and monitoring of firewall logs for unusual file access patterns or authentication anomalies that may indicate exploitation attempts.
- Employ web application firewalls or intrusion detection systems to detect and block suspicious requests targeting the vulnerable endpoint.
- Consider temporary compensating controls such as disabling or restricting the vulnerable endpoint if feasible until patches are applied.
- Educate security teams about the potential for chained exploitation with CVE-2023-30803 to ensure comprehensive defensive measures.
Description
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.