CVE-2025-59741

CriticalRCE

Published: 02 October 2025

Published

02 October 2025

Modified

02 October 2025

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0030 53.6th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59741 is a critical-severity Command Injection (CWE-77) vulnerability in Andsoft E-Tms. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-59741 is an operating system command injection vulnerability (CWE-77, CWE-78) affecting AndSoft's e-TMS version 25.03. The flaw resides in the handling of the 'm' parameter within the '/CLT/LOGINERRORFRM.ASP' endpoint, where unsanitized input from a POST request enables arbitrary command execution on the server. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it represents critical risk due to its high impact on confidentiality, integrity, and availability.

The vulnerability can be exploited remotely over the network by unauthenticated attackers with no privileges or user interaction required. By crafting a malicious POST request to the affected endpoint, an attacker can inject and execute arbitrary operating system commands on the server, potentially leading to full system compromise, data exfiltration, persistence, or further lateral movement within the environment.

INCIBE-CERT has issued an advisory detailing multiple vulnerabilities in AndSoft's e-TMS, including this one, under notice "update-24092025-multiple-vulnerabilities-andsofts-e-tms," recommending updates to mitigate the risks. Security practitioners should verify patch availability from the vendor and apply them promptly, alongside input validation and network segmentation as interim controls.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-32622
🇪🇸 INCIBE: www.incibe.es

Vulnerability details

Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'.

CWE(s): CWE-77 CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.003 Windows Command Shell Execution

Adversaries may abuse the Windows command shell for execution.

attack.mitre.org →

Why these techniques?

Unauthenticated remote command injection in a public-facing ASP web endpoint enables exploitation of public-facing applications (T1190) and arbitrary Windows command execution (T1059.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0