CVE-2025-15502 is a remote OS command injection vulnerability in Sangfor Operation and Maintenance Management System up to version 3.0.8. The vulnerability exists in the SessionController function within /isomp-protocol/protocol/session file, where manipulation of the Hostname argument leads to command injection. The attack can be executed remotely and public exploits are available. The vendor was contacted but did not respond to the disclosure.