CVE-2024-47256

mediumpriority · track · 0OT risk · elevatedEPSS 0.002 · 4 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.16% (4th) EPSS

CVSS 6 · medium

Is it mine?

3 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-24

Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may be used for decryption of certain data within backup files of 2N Access Commander version 1.14 and older. 2N has released an updated version 3.3 of 2N Access Commander, where this vulnerability is mitigated. It is recommended that all customers update 2N Access Commander to the latest version.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAccess Commandercisa_csaf_ot
Access Commander: Update to Access Commander Version 3.3 from the 2N download center.
https://www.2n.com/en-GB/download-center/?product=2n-access-commander&category=softwarefirmware&sort=category-desc
MitigationAccess Commandercisa_csaf_ot
2N has released the following fixes for these vulnerabilities:

cvss

Technical severity, 0–10. One row per scoring source.

6.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · CISA US

v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.16mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · product-security@axis.comexploitability 0.8 · impact 5.2

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-321USCWE-321US

affected products (3)

Products and version ranges known to be affected.

2N Access Commander: <=1.14all versionscisa_csaf_otUS
2N Access Commander≤ 1.14cisa_csaf_otUS
2N 2N Access Commander≤ 2N Access Commander 1.14 and priorenisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-24-319-172N Access Commander (Update A)2024-11-14icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to escalate their privileges, execute arbitrary code, or gain root access to the system.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

published 2025-02-06modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan