{"vulnerability": "CVE-2025-57790", "sightings": [{"uuid": "356e59b1-eeb8-40f9-8ad5-50f04b9b9603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb", "content": "", "creation_timestamp": "2025-09-16T20:30:50.000000Z"}, {"uuid": "d002a8d9-b8ac-4ac6-b7c0-8106863607f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:05.000000Z"}, {"uuid": "8e0d3597-7a08-4020-962f-804bec140e1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115061215891033628", "content": "", "creation_timestamp": "2025-08-20T13:00:25.322850Z"}, {"uuid": "4f377cf9-7fd6-4b04-8f80-cef3c74933ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115068722084002946", "content": "", "creation_timestamp": "2025-08-21T20:49:18.686250Z"}, {"uuid": "707ecce7-2a7b-4602-b157-c16590d58337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/220707d1-7e3e-4ed1-af30-61e39ddf5b1f", "content": "", "creation_timestamp": "2025-08-20T14:35:34.440648Z"}, {"uuid": "874f0292-e296-41dc-909f-97264b07a297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57790", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Sonny Macdonald\", \"Piotr Bazydlo\", \"remmons-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution exploit chain for Commvault,\\n          tracked as CVE-2025-57790 and CVE-2025-57791. A command-line injection permits unauthenticated\\n          access to the 'localadmin' account, which then facilitates code execution via expression\\n          language injection. CVE-2025-57788 is also leveraged to leak the target host name, which is\\n          necessary knowledge to exploit the remote code execution chain. This module executes in\\n          the context of 'NETWORK SERVICE' on Windows.\", \"disclosure_date\": \"2025-08-19\", \"fullname\": \"exploit/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791\", \"is_install_path\": true, \"mod_time\": \"2025-09-15 11:19:49 +0000\", \"name\": \"Commvault Command-Line Argument Injection to Traversal Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/commvault_rce_cve_2025_57790_cve_2025_57791\", \"references\": [\"CVE-2025-57790\", \"CVE-2025-57791\", \"CVE-2025-57788\", \"URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_1.html\", \"URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_2.html\", \"URL-https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:43.790048Z"}]}