CVE-2025-59707

CriticalUpdated

Published: 25 March 2026

Published

25 March 2026

Modified

25 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0031 54.0th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59707 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in N2Ws N2W. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely remediation of flaws such as this spoofing vulnerability via patching to prevent remote code execution and credential theft.

SI-5 Security Alerts, Advisories, and Directives good match

prevent

Mandates receiving and implementing vendor security advisories recommending upgrades to patched N2W versions to mitigate this CVE.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Enables proactive detection of the spoofing vulnerability in N2W software through regular vulnerability scanning.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Why these techniques?

Spoofing vulnerability in public-facing N2W application enables unauthenticated remote code execution (T1190) and account credential theft (T1212).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability.

Deeper analysisAI

CVE-2025-59707 is a spoofing vulnerability (CWE-290) affecting N2W versions prior to 4.3.2 and 4.4.x prior to 4.4.1. It enables potential remote code execution and theft of account credentials. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network with minimal effort. Successful exploitation allows arbitrary code execution on the affected system and exfiltration of account credentials, potentially leading to full system compromise.

Vendor advisories, including the N2WS security advisory update at https://n2ws.com/blog/security-advisory-update and release notes for N2W v4.3.2 at https://n2ws.zendesk.com/hc/en-us/articles/29817965452701-Release-notes-for-N2W-V4-3-2-August-2025, recommend upgrading to N2W 4.3.2 or 4.4.1 as the primary mitigation. Additional details are available at https://www.n2ws.com.