Access Commander
CVE-2025-59783
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges.
AnalysisAI
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges. [CVSS 7.2 HIGH]
Technical ContextAI
Classified as CWE-78 (OS Command Injection). Affects Access Commander. API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
More in Access Commander
View allInsufficient session invalidation in 2N Access Commander 3.4.2. Multiple sessions remain valid after logout.
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be incl
Access Commander contains a vulnerability that allows attackers to bypass password policy for backup file encryption (CV
2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today