2N Access Commander Man-In-The-Middle Vulnerability Due to Insecure Certificate Verification

A Man-In-The-Middle vulnerability has been identified in 2N Access Commander versions through 2.1. The issue arises from the software's default settings, which do not verify the certificates of 2N edge devices, leaving it open to interception attacks. 2N has released an updated version 3.3 that includes Certificate Fingerprint Verification. Additionally, starting from version 2.2, users can enforce TLS certificate validation. Customers are advised to update to the latest version and implement one of these validation practices.

Impact

Exploitation of this vulnerability allows for Man-In-The-Middle attacks, where an attacker can intercept and potentially alter communications between the user and the 2N edge devices.

Remediation

Users are recommended to update 2N Access Commander to version 3.3 or later and to enforce TLS certificate validation.