CVE-2025-59784 json
Log Pollution - Control Characters Not Escaped
published 2026-03-04 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-208277
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validation or sanitisation. This vulnerability can only be exploited after authenticating with administrator privileges.
Patch / fix
- 2N Telekomunikace a.s. 2N Access Commander 3.4.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- 2N Telekomunikace a.s. 2N Access Commander
Classification
- Weakness
-
- CWE-117 Improper Output Neutralization for Logs
References
-
2n.com
/en-GB/download/cve_2025_59784_acom_3_5_v1pdf
vendor-advisory
Sources
- CVE List CVE-2025-59784
- NVD CVE-2025-59784
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.