{"basis":"claimed","id":"CVE-2025-57789","name":"Vulnerability in Initial Administrator Login Process","vendorProject":"Commvault","product":"CommCell","publishedAt":"2025-08-20","cvss":{"score":5.3,"severity":"MEDIUM","version":"4.0"},"exploited":null,"epss":{"score":0.01229,"percentile":0.68909,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-12-03","daysToRule":105},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Vulnerability in Initial Administrator Login Process","description":"During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.","cwes":["CWE-257"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-12-03","firstIsNew":true,"daysToRule":105,"daysAtMost":null,"freePlan":false,"claims":[{"id":"752c5a307b314159795f80a2d5f37f70dd9f95747e5b3cd735f0baa9ae095ffa","cve_id":"CVE-2025-57789","vendor":"f5","product":"Attack signatures","rule_id":"200013133","rule_name":"CommVault Authentication Bypass","change":"new","default_action":null,"published_on":"2025-12-03","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013133 \"CommVault Authentication Bypass\" (Authentication/Authorization Attacks, risk High), systems: Java Servlets/JSP, Apache Tomcat. References: CVE-2025-57789.","first_seen_at":"2026-11-02T21:00:25.304Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:34.613Z","cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-57789","templatePath":"http/cves/2025/CVE-2025-57789.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/commandcenter/publicLink.do","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/commandcenter/api/Login","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"partial","templateId":"CVE-2025-57789","templatePath":"http/cves/2025/CVE-2025-57789.yaml","requests":2,"blockedRequests":1,"rules":["942120"],"note":"","requestDetail":[{"method":"GET","path":"/commandcenter/publicLink.do","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/commandcenter/api/Login","status":403,"blocked":true,"rules":["942120"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}