CVE-2025-57789

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-257

Affected software

Vendor	Product	Versions
Commvault	CommCell	>= 11.32.0, <= 11.32.101; >= 11.36.0, <= 11.36.59

References

https://documentation.commvault.com/securityadvisories/CV_2025_08_4.htmlVendor Advisory

Timeline

Published: Aug 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-57797.5A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerabil CVE-2025-577908.8A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversa CVE-2025-577916.5A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal CVE-2025-5779210.0Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web appl CVE-2025-577938.6Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a CVE-2025-577949.1Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. Th CVE-2025-577959.9Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default CVE-2025-577966.8Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, includi CVE-2025-577978.5Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is explo CVE-2025-577985.5Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain CVE-2025-577998.7StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an a CVE-2025-57807.5A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some u