PT-2025-5859 · 2N · 2N Access Commander

Jylsec · Published 2025-02-06 · Updated 2025-02-21 · CVE-2024-47256

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 2N Access Commander versions 1.14 and older

Description The issue allows an attacker with Admin access privileges to read a hardcoded AES passphrase, which can be used to decrypt certain data within backup files.

Recommendations For 2N Access Commander versions 1.14 and older, consider restricting access to the backup files and the hardcoded AES passphrase until a patch is available. As a temporary workaround, limit the use of Admin access privileges to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2024-47256

Affected Products

2N Access Commander

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-47256 · Security Note
• https://twitter.com/CVEnew/status/1887583247472681317 · Twitter Post
• https://twitter.com/CVETracker/status/1887954677515300903 · Twitter Post
• https://t.me/cvedetector/17422 · Telegram Post
• https://t.me/cvenotify/111988 · Telegram Post
• https://2n.com/en-GB/download/cve_2024_47256_acom_3_3_v1pdf · Note