CVE-2025-59736 is a critical (CVSS 9.8) OS command injection in AndSoft e-TMS 25.03. A POST request using the m parameter of /clt/LOGINFRM_DJO.ASP can run operating system commands on the server. No fixed version is confirmed, so restrict access and contact AndSoft.
What's affected
The record names AndSoft's e-TMS version 25.03 as affected. The source cited is a Spanish national CSIRT notice from INCIBE titled as an update of 24 September 2025 covering multiple vulnerabilities in AndSoft's e-TMS.
I could not load the INCIBE page from the command line, so I cannot confirm a fixed version. Check the INCIBE notice and ask AndSoft which release resolves it.
The affected page is /clt/LOGINFRM_DJO.ASP, and the parameter is m. This is one of nine closely related CVEs, CVE-2025-59735 to CVE-2025-59743, all published for e-TMS 25.03. Seven are command injection in different login related pages, and two are SQL injection.
How to check if you're exposed
Confirm whether you run e-TMS and which release. It is a transport management web application, so look for the ASP pages named in the record on your web server and in your reverse proxy logs.
grep -i "loginfrm_djo.asp" /var/log/nginx/access.log | head
Adjust the log path for your server. Look for POST requests to that page from addresses you do not expect, and for unexpected child processes on the web host.
What to do now
- Confirm the e-TMS version you run. The record names 25.03.
- Read the INCIBE notice and contact AndSoft for the fixed release.
- Restrict access to the application, ideally putting the login pages behind a VPN or an allow list.
- Place a web application firewall rule or reverse proxy restriction in front of the affected page while you wait.
- Review web and database server logs and account activity for anything unusual.
Why it matters
The record maps this to CWE-78 (OS command injection) and CWE-77 (command injection). The server passes a value from the m parameter to the operating system in a way that lets its content be treated as a command. The vector shows network access, low complexity, no privileges and high impact on all three properties.
A login page is reachable by definition before anyone has logged in, so there is no authentication barrier in front of it. Seven near identical pages in one product suggests a shared pattern, so fixing one page without fixing the pattern would leave others. It is not on the CISA KEV list, and the record has no exploitation information.
Command injection occurs when user input is passed to an operating system shell or command line without being neutralised. The shell then treats part of the input as instructions. The durable fix is to avoid the shell, call library functions directly where possible, and pass arguments as separate values rather than one assembled string.
For defenders, the practical signals are unexpected child processes spawned by a web server, and outbound connections from application servers that have no business making them. Both are worth alerting on for any internet facing application, whether or not this particular flaw applies to you.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Quick check
Which page does CVE-2025-59736 affect?
/clt/LOGINFRM_DJO.ASP, through the m parameter, per the record.
Does fixing one of the nine CVEs fix the rest?
Not necessarily. Each names a different page or parameter, so confirm with AndSoft that a release covers all of them.
Sources
- INCIBE CERT notice on AndSoft e-TMS (listed in the record, page did not load for me)
- NVD record data
Last reviewed: 18 October 2026.
