CVE-2025-59783
Published: 04 March 2026
Summary
CVE-2025-59783 is a high-severity OS Command Injection (CWE-78) vulnerability in 2N Access Commander. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-59783 is an OS command injection vulnerability (CWE-78) affecting the API endpoint for user synchronization in 2N Access Commander version 3.4.1. The issue arises from insufficient input validation, which allows malicious input to be processed as operating system commands. Published on 2026-03-04, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility and significant impacts on confidentiality, integrity, and availability.
Exploitation requires an attacker to first authenticate with administrator privileges on the affected system. Once authenticated, the attacker can inject and execute arbitrary OS commands remotely with low complexity and no user interaction required, potentially compromising the entire system.
The vendor has published an advisory with mitigation details, including a patch for 2N Access Commander version 3.5, available at https://www.2n.com/en-GB/download/cve_2025_59783_acom_3_5_v1pdf. Security practitioners should apply this update promptly to affected installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208276
Vulnerability details
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. This vulnerability can only be exploited after authenticating with administrator privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in network-accessible API endpoint directly enables remote arbitrary command execution (T1059) via public-facing application exploitation (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the user-synchronization API endpoint, blocking the malicious payloads that produce OS command injection.
Mandates prompt application of the vendor patch that eliminates the insufficient-input-validation flaw in version 3.4.1.
Limits the number of accounts that possess the administrator privileges required to reach and exploit the vulnerable endpoint.