External risk intelligence

AndSoft e-TMS OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59735

The vulnerability affects a login form (/clt/LOGINFRM.ASP) within a web-based transport management system. Because this is a web application component designed to handle user authentication, it is typically deployed as an internet-facing service or accessible portal to allow remote access by users, making it a common target for external network-based interaction.

OS Command Injection

Andsoft E Tms

25.03

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An operating system command injection vulnerability has been identified in AndSoft's e-TMS, potentially allowing unauthorized commands to be executed on the server. This issue stems from how the system handles a specific parameter within its login form. The primary concern is to confirm if this specific product and version are in use and exposed to potential threats.

Attackers can run commands on servers.
This affects login functions in a transport system.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the server. This request targets the login form of the e-TMS application, specifically interacting with the 'm' parameter. If successful, the attacker can inject operating system commands, which the server then executes.

Entry condition: Network access to the login form.
Trigger point: Sending a malicious POST request.
Resulting risk: Server command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands on the server when it receives a specially crafted POST request to the `/clt/LOGINFRM.ASP` endpoint. The system data, including sensitive operational information and potentially customer or financial data processed by the e-TMS system, could be affected.

Server operating system commands.
Sending a malicious POST request.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This operating system command injection vulnerability in AndSoft's e-TMS impacts technical operations and requires immediate attention from teams responsible for the application and its underlying infrastructure. The first practical step is to pinpoint all instances of e-TMS, assess their exposure and business criticality, and identify the accountable owner for remediation planning.

Application owners and infrastructure teams should lead.
Verify external accessibility and critical systems first.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AndSoft e-TMS?

AndSoft e-TMS (e-Transport Management System) is a software platform designed to help logistics and transport companies manage their daily operations. It acts as a central hub for handling freight, routes, and business data, often deployed as a web-based service so that drivers, staff, and partners can access the portal remotely via a browser.

What does command injection mean for CVE-2025-59735?

This vulnerability is classified as OS Command Injection (CWE-77/CWE-78). It means the application fails to properly clean input before processing it. By sending a specific, malicious POST request to the login form, an attacker can trick the underlying server into running unintended operating system commands with the application's own permissions.

How is this vulnerability triggered?

The flaw is triggered by sending a specially crafted HTTP POST request to the '/clt/LOGINFRM.ASP' endpoint. Specifically, the system incorrectly handles the 'm' parameter in this request. If the application receives this manipulated input, it executes the embedded commands. Simply visiting the page or using a standard GET request will not trigger this execution.

Is my e-TMS instance at risk?

Halo Surface Signal indicates that because this vulnerability exists within a login portal, these systems are frequently configured to be internet-facing to support remote user access. If your e-TMS portal is reachable from the public internet, it faces a significantly higher risk of interaction from external, unauthorized actors compared to systems restricted to internal networks.

What should I do if I run e-TMS?

Your priority is to identify all active installations of e-TMS version 25.03 within your environment. Once identified, evaluate whether these instances are accessible from the internet and determine their role in your business. Coordinate with your application and infrastructure teams to track down the official vendor update or guidance to resolve the underlying input handling issue.

References

www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.