CVE-2025-59735: Andsoft E-tms RCE Vulnerability

CVE-2025-59735 Overview

An operating system command injection vulnerability has been identified in AndSoft's e-TMS version 25.03. This critical vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands on the server by sending a specially crafted POST request. The injection point exists in the m parameter within the /clt/LOGINFRM.ASP endpoint, making this a serious threat to affected systems.

Critical Impact

Unauthenticated attackers can achieve full remote command execution on vulnerable e-TMS servers, potentially leading to complete system compromise, data exfiltration, and lateral movement within affected networks.

Affected Products

• AndSoft e-TMS version 25.03

Discovery Timeline

• October 2, 2025 - CVE-2025-59735 published to NVD
• October 2, 2025 - Last updated in NVD database

Technical Details for CVE-2025-59735

Vulnerability Analysis

This vulnerability stems from insufficient input validation in AndSoft's e-TMS web application. The /clt/LOGINFRM.ASP endpoint accepts user-supplied data through the m parameter without proper sanitization, allowing attackers to inject and execute arbitrary operating system commands on the underlying server. Because the vulnerability exists in a login-related endpoint, it can be exploited without prior authentication, significantly increasing the risk profile.

The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user input is directly passed to system command execution functions without adequate filtering or escaping.

Root Cause

The root cause is improper input validation and command injection in the ASP-based login form handler. The m parameter value is incorporated into operating system commands without sanitization, allowing metacharacters and command separators to be interpreted by the underlying shell. This is a classic case of untrusted user input being directly concatenated into system command strings.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious POST request to the /clt/LOGINFRM.ASP endpoint with a crafted m parameter containing OS command injection payloads. Common injection techniques include using shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax to append or chain arbitrary commands.

The vulnerability allows attackers to execute commands with the privileges of the web application process, which could enable full system compromise, installation of backdoors, data theft, or use of the compromised server as a pivot point for further attacks.

Detection Methods for CVE-2025-59735

Indicators of Compromise

• Unusual POST requests to /clt/LOGINFRM.ASP containing shell metacharacters (;, |, &, `, $()) in the m parameter
• Unexpected child processes spawned by the IIS worker process or ASP engine
• Network connections originating from the web server to external command-and-control infrastructure
• Modified system files, new user accounts, or scheduled tasks created by the web server process

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block command injection patterns in POST parameters
• Monitor web server logs for anomalous requests to /clt/LOGINFRM.ASP with suspicious parameter values
• Deploy endpoint detection solutions to identify command execution chains originating from web application processes
• Use intrusion detection systems (IDS) with signatures for common OS command injection payloads

Monitoring Recommendations

• Enable detailed logging for the e-TMS application and monitor for command injection patterns
• Configure security information and event management (SIEM) alerts for suspicious process creation events on e-TMS servers
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Monitor outbound network connections from the e-TMS server for signs of data exfiltration or reverse shell activity

How to Mitigate CVE-2025-59735

Immediate Actions Required

• Restrict network access to the e-TMS application to trusted IP ranges only until patches are applied
• Place the e-TMS server behind a web application firewall with command injection protection enabled
• Review server logs for any signs of exploitation and investigate suspicious activity
• Consider temporarily disabling the affected endpoint if business operations permit

Patch Information

Organizations should refer to the INCIBE Security Notice for official patch information and vendor guidance. Contact AndSoft directly for the latest security updates for e-TMS.

Workarounds

• Implement strict input validation at the web application firewall level to block command injection attempts
• Use network segmentation to isolate the e-TMS server from critical internal resources
• Disable or restrict access to the /clt/LOGINFRM.ASP endpoint if not required for operations
• Apply principle of least privilege to the service account running the e-TMS application to limit potential damage from exploitation

# Example WAF rule to block command injection in the 'm' parameter
# This is a general mitigation approach - consult your WAF documentation
# Block requests containing shell metacharacters in POST body
SecRule ARGS:m "@rx [;|&`$\(\)]" "id:100001,phase:2,deny,status:403,msg:'Potential command injection in m parameter'"