Cyber Resilience

CVE-2025-57789

Medium

Published: 20 August 2025

Published
20 August 2025
Modified
10 September 2025
KEV Added
—
Patch
—
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0654 91.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-57789 is a medium-severity Storing Passwords in a Recoverable Format (CWE-257) vulnerability in Commvault Commvault. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

CWE(s)
CWE-257

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

commvault
commvault
≤ 11.36.60

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References