CVE-2025-59785
2N Access Commander ≤ 3.5
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-59785 is a medium-severity Improper Validation of Syntactic Correctness of Input (CWE-1286) vulnerability in 2N Access Commander. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-59785 is an improper validation vulnerability in an API endpoint of 2N Access Commander version 3.4.2 and prior versions. It enables attackers to bypass the password policy enforced for backup file encryption. The issue is cataloged under CWE-1286 and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2026-03-04.
Exploitation requires an attacker to first authenticate with administrator privileges on the affected system. Once authenticated, the attacker can invoke the vulnerable API endpoint to circumvent password policy requirements during backup file creation, potentially resulting in weakly protected backups that expose sensitive configuration data, user credentials, or access control information. The high-impact CVSS vector indicates significant confidentiality, integrity, and availability consequences in a network-accessible environment with low attack complexity.
The vendor 2N has issued an advisory detailing mitigation, available at https://www.2n.com/en-GB/download/cve_2025_59785_acom_3_5_v1pdf, which addresses the issue in Access Commander version 3.5. Security practitioners should apply the patch promptly and review access logs for unauthorized admin activity on vulnerable installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208278
Vulnerability Data
Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption. This vulnerability can only be exploited after authenticating with administrator privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs for correctness, directly stopping syntactic validation failures from being introduced or exploitable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require syntactic input validation to prevent malformed data handling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect syntax validation.
Secure development life cycle mandates input validation to ensure syntactic correctness.
Application security requirements explicitly call for validation of input syntax.
Secure architecture principles reduce the likelihood of missing syntactic checks.
Secure coding standards directly require proper syntactic validation of all inputs.