PT-2026-22930 · 2N · 2N Access Commander

CVE-2025-59783 · Publicado 2026-03-04 · Atualizado 2026-03-05

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions 2N Access Commander version 3.4.1

Description The user synchronization API endpoint in 2N Access Commander version 3.4.1 lacks sufficient input validation, which allows for OS command injection. Exploitation requires administrator privileges.

Recommendations Apply input validation to the user synchronization API endpoint.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2025-59783

Produtos afetados

2N Access Commander

Referências · 7

• https://osv.dev/vulnerability/CVE-2025-59783 · Aviso do Fabricante
• https://2n.com/en-GB/download/cve_2025_59783_acom_3_5_v1pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59783 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2029234551331885389 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2029272851757289966 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2029273410249895979 · Publicação no Twitter
• https://twitter.com/threatcluster/status/2029618191182283172 · Publicação no Twitter