CVE-2025-59784
2N Access Commander ≤ 3.4.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-59784 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in 2N Access Commander. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indicator Removal (T1070); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-59784 is a log pollution vulnerability (CWE-117) affecting 2N Access Commander version 3.4.1 and prior versions. The issue arises when certain parameters sent over the API are included in logs without prior validation or sanitization, published on 2026-03-04 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability requires an attacker to first authenticate with administrator privileges before exploitation. A malicious administrator can send crafted API parameters that pollute the logs with unsanitized content, potentially leading to high impacts on confidentiality, integrity, and availability as indicated by the CVSS vector.
The vendor 2N has published an advisory detailing mitigation at https://www.2n.com/en-GB/download/cve_2025_59784_acom_3_5_v1pdf, which references Access Commander 3.5.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208277
Vulnerability Data
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validation or sanitisation. This vulnerability can only be exploited after authenticating with administrator privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect output neutralization when log messages are constructed from untrusted input.
Input validation reduces the chance that specially crafted data reaches log-message construction routines.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices and coding standards directly require output sanitization for logs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect log injection flaws but does not prevent them at the source.
Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
Secure SDLC includes coding standards that reduce log-related weaknesses but does not specifically address logging.
Secure coding practices mandate input validation and output encoding, directly preventing log injection.