CVE-2025-57789

published 2025-08-20

CVE-2025-57789: During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This…

Priority P3 38 medium 5.4 CVSS 3.1

AV N AC L PR L UI N S U C L I L A N

EXPLOIT

During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
commvault	commcell	11.32.0 – 11.32.101	—
commvault	commcell	11.36.0 – 11.36.59	—
commvault	commvault	< 11.36.60	11.36.60

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

nvd v4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-257