CVE-2025-59706: Remote Code Execution in N2W Before 4.3.2 and 4.4.1

CVE-2025-59706 is a critical remote code execution flaw in N2W backup software, scored CVSS 9.8. Improper validation of API request parameters allows it. The fixed versions are 4.3.2 and 4.4.1, so update any N2W 4.3.x or 4.4.0 instance now. Backup tools hold cloud credentials, so treat it as urgent.

What's affected

The NVD record says N2W versions before 4.3.2 are affected, and so are 4.4.0 builds before 4.4.1. Fixed versions are 4.3.2 and 4.4.1. N2W's 4.3.2 release notes are dated August 2025.

The same release fixes CVE-2025-59707, a spoofing issue that the record links to code execution and credential theft. Both are tagged CWE-290, authentication bypass by spoofing. The vendor's own advisory page and release notes are linked below. They returned access errors when I tried to fetch them, so I rely on the NVD record here.

How to check if you're exposed

N2W is a cloud backup service you deploy in your own cloud account. Open its management console and read the version from the About or support page. If it reads below 4.3.2, or it is 4.4.0, you are in the affected range.

Then look at exposure. Check whether the N2W instance's web and API ports are reachable from the internet. Check the cloud security group rules and the load balancer in front of it.

What to do now

1. Upgrade N2W to 4.3.2, or to 4.4.1 if you are on the 4.4 line.
2. Follow the vendor's upgrade guide and take a snapshot of the instance first.
3. Limit access to the API and console to known address ranges or a VPN.
4. Review the cloud credentials N2W holds and rotate those you cannot account for, because the companion CVE mentions credential theft.
5. Check logs for unusual API calls from unknown addresses.
6. Read the vendor's security advisory page for any extra steps.

Why it matters

The CWE tag is CWE-290, authentication bypass by spoofing, though the description frames this one as improper validation of API request parameters leading to code execution. Both point to the same lesson: an API must check every parameter and every caller on the server, because anyone who can reach it can send anything.

Backup tools hold cloud access keys with wide rights, so remote code execution on one is serious beyond the single host. The critical score reflects a network attack with no stated need for credentials. The KEV flag is false, and I found no vendor statement of exploitation.

Quick check

Sources

• N2W security advisory update (referenced by the record)
• N2W 4.3.2 release notes (referenced by the record)

Last reviewed: 19 October 2026.