An OS command injection vulnerability (CWE-78) exists in Sangfor Technologies' Endpoint Detection and Response Platform, specifically in the Chinese-language versions 3.2.16, 3.2.17, and 3.2.19. The flaw permits unauthenticated attackers to craft and send malicious HTTP requests to the EDR Manager interface, enabling arbitrary command execution with elevated privileges. This vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploitation was confirmed by Shadowserver Foundation on 2025-02-04 UTC.

Successful exploitation allows unauthenticated attackers to execute arbitrary OS commands on the affected EDR Manager interface with elevated privileges, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. Given the critical CVSS score and observed exploitation evidence, this poses a severe risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the EDR Manager interface to trusted networks and monitor for suspicious HTTP requests targeting this interface. Follow vendor communications closely for updates on patches or official mitigations.