PT-2026-22930 · 2N · 2N Access Commander

Published 2026-03-04 · Updated 2026-03-05 · CVE-2025-59783

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions 2N Access Commander version 3.4.1

Description The user synchronization API endpoint in 2N Access Commander version 3.4.1 lacks sufficient input validation, which allows for OS command injection. Exploitation requires administrator privileges.

Recommendations Apply input validation to the user synchronization API endpoint.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-59783

Affected Products

2N Access Commander

References · 7

• https://osv.dev/vulnerability/CVE-2025-59783 · Vendor Advisory
• https://2n.com/en-GB/download/cve_2025_59783_acom_3_5_v1pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59783 · Security Note
• https://twitter.com/cyberbivash/status/2029234551331885389 · Twitter Post
• https://twitter.com/CVEnew/status/2029272851757289966 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029273410249895979 · Twitter Post
• https://twitter.com/threatcluster/status/2029618191182283172 · Twitter Post