External risk intelligence

AndSoft e-TMS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-59740

The vulnerability affects a login form (/clt/LOGINFRM_CAT.ASP) within a transport management system (e-TMS). As a login portal, this component is designed to be internet-facing to facilitate remote user access, making it a public-facing entry point in standard deployments.

OS Command Injection

Andsoft E Tms

25.03

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical operating system command injection vulnerability has been identified in AndSoft's e-TMS software. This flaw allows unauthorized attackers to execute arbitrary commands on the server by sending a specially crafted POST request to the login form. The potential impact of this vulnerability is significant, as it could lead to a complete compromise of the affected server.

Attackers can run commands on servers.
It affects a core login function.
Confirm relevance and exposure to e-TMS.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the e-TMS server. This request targets the `/clt/LOGINFRM_CAT.ASP` endpoint, specifically manipulating the 'm' parameter. If successful, the attacker can then execute arbitrary operating system commands on the server.

No authentication or user interaction needed.
Sending a POST request to a login form.
Server-side command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the server by sending a specially crafted POST request to the login form. This could potentially lead to a complete compromise of the affected server and any data it processes.

Server operating system commands.
Via a POST request to the login form.
Complete server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical command injection vulnerability in AndSoft's e-TMS impacts the system's login component, suggesting that application owners and potentially infrastructure or network security teams are the primary responders. The first practical step involves locating all instances of e-TMS, assessing their exposure and criticality, identifying the specific accountable owner for each instance, and then prioritizing remediation efforts.

Application owners should manage the issue.
Verify external reachability and business criticality first.
Coordinate with the vendor for a permanent fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AndSoft e-TMS?

AndSoft e-TMS is a Transport Management System software suite designed to help logistics and freight companies organize, track, and manage their shipping operations. It acts as a centralized platform for processing data related to transportation activities, and because it supports remote workflows, it often includes web-based interfaces to allow users and partners to log in from various locations.

What does CVE-2025-59740 mean by command injection?

This vulnerability is classified as OS Command Injection (CWE-77/CWE-78). It means the application improperly handles user-provided data, allowing an attacker to insert their own instructions into the server's operating system. Instead of just processing a login attempt, the server inadvertently executes these malicious commands with the same privileges as the application itself, potentially granting the attacker full control over the host server.

How is this vulnerability triggered?

The vulnerability is triggered by sending a specific, maliciously crafted POST request to the application's login page at '/clt/LOGINFRM_CAT.ASP'. The attack specifically targets the 'm' parameter within that request. It is important to note that this does not require an attacker to have a valid account, nor does it require any interaction from a legitimate user; the server processes the request automatically as part of the login flow.

Why should I care about this if my e-TMS is internal?

According to Halo Surface Signal, this vulnerability affects a login portal designed to be internet-facing for remote access, making it a highly accessible entry point for unauthorized users. If your instance is exposed to the internet, it is at higher risk. While internal instances are less accessible to global attackers, they remain vulnerable to anyone already inside your network, so all deployments should be treated as high priority.

What should I do first to address this?

Your first step is to inventory all systems running AndSoft e-TMS version 25.03 to understand your organization's footprint. Once identified, determine which instances are reachable from the internet, as these require immediate attention. Assign responsibility to the appropriate application owners to track these systems and prepare to coordinate with AndSoft for the necessary security updates or configuration changes to resolve the vulnerability.

References

www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.