CVE-2025-59736
Published: 02 October 2025
Summary
CVE-2025-59736 is a critical-severity Command Injection (CWE-77) vulnerability in Andsoft E-Tms. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents command injection by validating and sanitizing the untrusted 'm' parameter in the vulnerable POST request to '/clt/LOGINFRM_DJO.ASP'.
SI-2 mitigates the vulnerability by identifying, reporting, and applying patches or updates for the specific command injection flaw in e-TMS v25.03 as advised by INCIBE-CERT.
SI-9 restricts the 'm' parameter input to safe types, formats, and lengths, reducing the attack surface for command injection exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (T1190) via unauthenticated remote command injection, directly facilitating arbitrary OS command execution (T1059).
NVD Description
Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_DJO.ASP'.
Deeper analysisAI
CVE-2025-59736 is an operating system command injection vulnerability (CWE-77, CWE-78) in AndSoft's e-TMS version 25.03. The issue stems from improper handling of the 'm' parameter in the '/clt/LOGINFRM_DJO.ASP' endpoint, enabling attackers to inject and execute arbitrary operating system commands on the server through a specially crafted POST request. Published on 2025-10-02, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.
The vulnerability is exploitable remotely over the network by any unauthenticated attacker, requiring low complexity and no user interaction or privileges. A successful attack involves sending a malicious POST request to the vulnerable endpoint, allowing command execution on the server and potential full compromise, such as unauthorized access to sensitive data, system modification, or disruption of services.
INCIBE-CERT has issued an advisory on multiple vulnerabilities in AndSoft's e-TMS, including CVE-2025-59736, available at https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms. Practitioners should consult this notice for details on available updates, patches, and mitigation recommendations.
Details
- CWE(s)