CVE-2025-59785 Details
Description
Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption. This vulnerability can only be exploited after authenticating with administrator privileges.
A vulnerability exists in 2N Access Commander versions through 3.4.2 due to improper validation of an API endpoint. This flaw allows an authenticated attacker with administrator privileges to bypass the password policy for encrypting backup files.
Users are advised to update to 2N Access Commander version 3.5 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.2n.com/en-GB/download/cve_2025_59785_acom_3_5_v1pdf | 2N | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | 2N |
Affected Products
| Product | Versions |
|---|---|
| 2n access commander | < 3.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | 2N |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | 2N |