Description
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection.
This vulnerability can only be exploited after authenticating with administrator privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 2N Telekomunikace a.s. | 2N Access Commander | < 3.4.2 | 3.4.2 |
References
- https://www.2n.com/en-GB/download/cve_2025_59783_acom_3_5_v1pdf vendor-advisory