External risk intelligence

AndSoft e-TMS OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59737

The vulnerability exists in a login form endpoint (/clt/LOGINFRM_LXA.ASP) of a Transport Management System (e-TMS). Login portals and web-based management interfaces for enterprise applications are designed to be public-facing or internet-accessible by default to facilitate remote user access.

OS Command Injection

Andsoft E Tms

25.03

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical operating system command injection vulnerability identified in AndSoft's e-TMS software. The flaw allows an unauthenticated attacker to execute commands on the server through a specially crafted POST request targeting the login form. This could potentially lead to a compromise of the affected server.

Attackers can run commands on vulnerable servers.
This affects our transport management system's login.
Confirm relevance and exposure of the system.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the `/clt/LOGINFRM_LXA.ASP` endpoint. This request targets a specific parameter within the login form, allowing the attacker to inject operating system commands that will be executed on the server. The system could then perform actions dictated by the attacker.

No authentication or special access required.
Sending a POST request to the login endpoint.
Arbitrary operating system command execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the server when they send a specially crafted POST request to a specific login endpoint. The commands would run with the privileges of the web server process.

System commands could be executed remotely.
Via a POST request to a login endpoint.
Unauthorized command execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this operating system command injection vulnerability in e-TMS, as it affects a server-side component accessible via a POST request. The first practical step is to identify all instances of e-TMS, confirm their exposure and criticality, and then engage the accountable owner to plan remediation based on the assessed risk.

Application and infrastructure teams own this.
Verify e-TMS instances and exposure first.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AndSoft e-TMS?

AndSoft e-TMS is a Transport Management System software suite designed to help logistics and transportation companies manage their operations. The specific version 25.03 contains a component for handling web-based user logins, which is the part of the system affected by this vulnerability.

What does OS command injection mean for CVE-2025-59737?

This vulnerability, classified as CWE-77/CWE-78, occurs when software improperly processes input, allowing an attacker to insert their own operating system commands. In this case, the application fails to sanitize data sent to the login form, effectively letting the attacker 'inject' instructions that the underlying server executes as if they were legitimate system tasks.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted HTTP POST request to the '/clt/LOGINFRM_LXA.ASP' login page. The attack relies on manipulating the 'm' parameter within that request. It is important to note that the vulnerability does not require any prior authentication or special user privileges; simple reachability to this specific endpoint is sufficient.

Is my instance of e-TMS at risk?

According to Halo Surface Signal, this vulnerability is considered very likely to be reachable because it resides in a login portal, which enterprise systems often expose to the internet to support remote access. If your e-TMS login page is accessible from outside your internal network, your installation carries a higher level of risk compared to internal-only systems.

What should I do first to address this?

Start by identifying all servers in your environment running AndSoft e-TMS version 25.03. Once you have a complete inventory, verify whether these instances are exposed to the internet or restricted to internal networks. After assessing your exposure, coordinate with your infrastructure and application owners to prioritize and plan the necessary remediation steps.

References

www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.