CVE-2025-59741: Andsoft E-tms RCE Vulnerability

CVE-2025-59741 Overview

CVE-2025-59741 is a critical operating system command injection vulnerability affecting AndSoft's e-TMS version 25.03. This vulnerability allows unauthenticated attackers to execute arbitrary operating system commands on the server by sending a specially crafted POST request to the /CLT/LOGINERRORFRM.ASP endpoint. The vulnerability resides in the improper handling of the m parameter, which fails to properly sanitize user input before passing it to system command execution functions.

Critical Impact

Unauthenticated remote attackers can achieve full system compromise by executing arbitrary OS commands on vulnerable e-TMS servers, potentially leading to complete takeover of the transportation management system infrastructure.

Affected Products

• AndSoft e-TMS version 25.03
• Potentially earlier versions of AndSoft e-TMS (unconfirmed)

Discovery Timeline

• 2025-10-02 - CVE-2025-59741 published to NVD
• 2025-10-02 - Last updated in NVD database

Technical Details for CVE-2025-59741

Vulnerability Analysis

This command injection vulnerability occurs in the login error handling functionality of AndSoft's e-TMS transportation management system. The vulnerable endpoint /CLT/LOGINERRORFRM.ASP accepts user-controlled input through the m parameter without proper sanitization or validation. When this parameter is processed by the application, the unsanitized input is passed directly to operating system command execution functions, allowing attackers to inject and execute arbitrary commands with the privileges of the web server process.

The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command), both of which relate to command injection attack patterns. The network-accessible nature of this vulnerability, combined with the lack of authentication requirements and the ability to achieve full system compromise, makes this an extremely dangerous flaw.

Root Cause

The root cause of this vulnerability is the failure to implement proper input validation and sanitization on the m parameter in the LOGINERRORFRM.ASP script. The application directly incorporates user-supplied data into system command execution without escaping shell metacharacters or using parameterized command interfaces. This allows attackers to break out of the intended command context and inject additional commands using shell metacharacters such as semicolons, pipes, or command substitution operators.

Attack Vector

The attack vector for CVE-2025-59741 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a malicious POST request to the vulnerable endpoint with specially crafted payload in the m parameter.

The exploitation process involves:

1. Identifying an exposed e-TMS server with the vulnerable /CLT/LOGINERRORFRM.ASP endpoint
2. Crafting a POST request containing OS command injection payload in the m parameter
3. Sending the request to the target server
4. The server executes the injected commands with the privileges of the web application process

Successful exploitation grants the attacker the ability to execute arbitrary system commands, which can be leveraged for data exfiltration, establishing persistence, lateral movement, or complete system takeover. For additional technical details, refer to the INCIBE Security Notice.

Detection Methods for CVE-2025-59741

Indicators of Compromise

• Unusual POST requests to /CLT/LOGINERRORFRM.ASP containing shell metacharacters (;, |, &, `, $()) in the m parameter
• Unexpected process spawning from the IIS worker process (w3wp.exe) or ASP.NET runtime
• Web server logs showing encoded command sequences in request parameters
• Anomalous outbound network connections from web server processes

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block command injection patterns in HTTP POST parameters
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious child process creation from web server processes
• Configure intrusion detection systems (IDS) to alert on requests containing common command injection payloads targeting ASP endpoints
• Enable detailed logging for the e-TMS application and monitor for suspicious parameter values

Monitoring Recommendations

• Review web server access logs for requests to /CLT/LOGINERRORFRM.ASP with unusual parameter content
• Monitor process creation events on servers running e-TMS for unexpected command-line tools being spawned
• Implement real-time alerting for any command execution anomalies originating from web application processes
• Track network connections initiated by web server processes to detect potential command-and-control activity

How to Mitigate CVE-2025-59741

Immediate Actions Required

• Restrict network access to e-TMS servers to trusted IP addresses only using firewall rules
• Implement a web application firewall (WAF) in front of vulnerable e-TMS instances with rules to block command injection attempts
• Audit logs for evidence of exploitation attempts targeting the /CLT/LOGINERRORFRM.ASP endpoint
• Contact AndSoft support to obtain information about available patches or updates

Patch Information

Organizations should consult the INCIBE Security Notice for the latest information regarding patches and remediation guidance from the vendor. Contact AndSoft directly for updated versions that address this vulnerability.

Workarounds

• Disable or restrict access to the /CLT/LOGINERRORFRM.ASP endpoint if it is not required for business operations
• Implement network segmentation to isolate e-TMS servers from critical infrastructure
• Deploy application-layer filtering to sanitize input parameters before they reach the vulnerable endpoint
• Consider placing e-TMS behind a reverse proxy with strict input validation rules

# Example IIS URL Rewrite rule to block suspicious requests (add to web.config)
# This is a temporary mitigation and should not replace vendor patches
<rule name="Block Command Injection Attempts" stopProcessing="true">
    <match url=".*LOGINERRORFRM\.ASP.*" />
    <conditions>
        <add input="{QUERY_STRING}" pattern="[;|&`$()]" />
    </conditions>
    <action type="AbortRequest" />
</rule>