CVE-2025-59783highCWE-78

CVE-2025-59783: high-severity vulnerability in 2N Access Commander

OS Command Injection over API

Published

Follow this CVE+ Monitor 2N Access Commander

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.0%
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
2N Telekomunikace a.s. · 2N Access Commander
Related CVEs — 2N Access Commander

In the same product, most dangerous first.

CVE-2025-59784MEDIUMLog Pollution - Control Characters Not EscapedEPSS 0.3%CVE-2025-59786MEDIUMCookies are not Invalidated upon Logout and Password ChangeEPSS 0.3%CVE-2025-59787MEDIUMHTTP 5XX Internal Server ErrorsEPSS 0.2%CVE-2025-59785MEDIUMAPI - Insufficient Input ValidationEPSS 0.2%