by Kastro
Paper/Archive/CVE-2025-59786

CVE-2025-59786

2N Telekomunikace a.s. 2N Access Commander — Cookies are not Invalidated upon Logout and Password Change

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 21.6.216 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.

Affected

ProductAffectedFixed inSource
2N Access Commander< 3.53.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2N (CNA)6.0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisory2n.com/en-GB/download/cve_2025_59786_acom_3_5_v1pdf