PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47256 2N CVE debrief

A medium-severity vulnerability in 2N Access Commander versions 1.14 and prior allows attackers with administrative privileges to extract hardcoded AES passphrases. These passphrases may enable decryption of sensitive data within backup files. The issue was disclosed on November 14, 2024, with an advisory update published February 11, 2025. 2N has released Access Commander version 3.3 as a fix.

Vendor
2N
Product
Access Commander
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-14
Original CVE updated
2025-02-11
Advisory published
2024-11-14
Advisory updated
2025-02-11

Who should care

Organizations using 2N Access Commander for physical access control management, particularly those maintaining backups of system configurations. Security teams responsible for industrial control systems and building access management infrastructure should prioritize patching. Administrators with backup retention policies spanning multiple versions should assess exposure of historical backup data.

Technical summary

In 2N Access Commander versions 1.14 and prior, AES encryption passphrases are hardcoded within the application. An attacker with administrative access privileges can read these passphrases and use them to decrypt data contained within backup files. The vulnerability requires local access and high privileges, limiting exposure but creating significant impact for confidentiality and integrity of backed-up system data. The CVSS 3.1 score of 6.0 reflects this attack vector and privilege requirement.

Defensive priority

medium

Recommended defensive actions

  • Upgrade 2N Access Commander to version 3.3 or later from the 2N download center
  • Review and rotate any credentials or keys that may have been exposed in backup files from affected versions
  • Restrict administrative access to Access Commander systems to authorized personnel only
  • Audit backup file storage locations and ensure encryption at rest for backup archives
  • Monitor for unauthorized access attempts to Access Commander administrative interfaces

Evidence notes

CISA ICS advisory ICSA-24-319-17 (Update A) documents this vulnerability with CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The advisory confirms administrative access is required for exploitation and that hardcoded AES passphrases in backup files are the exposure vector. Vendor fix version 3.3 was released to address this issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-47256 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-47256

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-47256 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-47256

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-17.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-17

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.