External risk intelligence

AndSoft e-TMS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59736

The vulnerability resides in a login form ('/clt/LOGINFRM_DJO.ASP') of a web-based transport management system. Login pages are fundamental, internet-facing entry points designed to be accessible to external users, making this service public-facing by design in normal deployment scenarios.

OS Command Injection

Andsoft E Tms

25.03

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical operating system command injection vulnerability has been identified in AndSoft's e-TMS software. This flaw could permit unauthorized attackers to execute commands on the server by sending a specially crafted POST request, potentially impacting the integrity and availability of the system. The main concern is confirming the relevance and exposure of this technology within our environment.

A server command flaw could allow unauthorized access.
It affects a critical transport management system.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the login form. This request targets a specific parameter within the login process, allowing the attacker to inject operating system commands that will be executed on the server.

No authentication or special access needed.
Sending a POST request to a login parameter.
Arbitrary OS command execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the server by sending a specially crafted POST request to the login form. This could affect the integrity and availability of the e-TMS system and its hosted data.

Server-side command execution.
Unauthenticated POST request.
Compromised system data and services.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical operating system command injection vulnerability in e-TMS. The first practical step is to identify all instances of e-TMS, confirm their accessibility from the internet and their business criticality, and then assign an owner to oversee the remediation process.

Identify and assign e-TMS owners.
Verify external reachability and business impact.
Plan and coordinate risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AndSoft e-TMS?

AndSoft e-TMS is a web-based transport management system used by logistics and shipping companies to orchestrate supply chain operations. It centralizes fleet tracking, order management, and distribution workflows. Because it functions as a backend platform for managing active shipments and transportation data, it typically resides on servers that handle high volumes of external traffic to support drivers, partners, and customers.

What does command injection mean for CVE-2025-59736?

This vulnerability is classified as OS Command Injection (CWE-77/78). It means the software does not properly filter input before passing it to the server's underlying operating system. By sending a malicious POST request, an attacker can trick the server into running unintended system-level commands, potentially allowing them to interact with files, services, or configurations on the host machine itself.

How is this vulnerability triggered?

The flaw is triggered by sending a specially crafted POST request to the specific file '/clt/LOGINFRM_DJO.ASP' using the 'm' parameter. Because this interaction occurs at the login stage, it does not require an attacker to have a valid username or password. Simply reaching the login form with the correctly malformed input is sufficient to initiate the command execution.

Is my e-TMS instance at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your e-TMS instance is internet-facing. Because the flaw exists within a login form designed to be accessible to external users, systems exposed to the public web are at the highest risk. You should prioritize assessing any deployment where this login page is reachable without restricted access or private network controls.

How do I start responding to this CVE?

The first step is to locate all active e-TMS deployments within your environment. Once identified, map which instances are reachable from the internet versus those kept strictly internal. Assign ownership to the appropriate infrastructure or application teams immediately so they can oversee the transition to a patched version and ensure the login interface is secured.

References

www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.