CVE-2025-57788

Summary

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

Affected Software

Weaknesses

• CWE-259: CWE-259: Use of Hard-coded Password

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/#wt-2025-0047hardcoded-credentials

References

• https://documentation.commvault.com/securityadvisories/CV_2025_08_3.html

• ←Previous
• Next→