{"vulnerability": "cve-2025-57788", "sightings": [{"uuid": "b92a05a0-7b41-4300-b74b-9cc7b2396389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb", "content": "", "creation_timestamp": "2025-09-16T20:30:50.000000Z"}, {"uuid": "b872aaa9-a13c-46ae-88d3-37d6f8659688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:05.000000Z"}, {"uuid": "29ff254c-8e60-430f-8e85-d66ad4e0335b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lz2qb2ntsu2i", "content": "", "creation_timestamp": "2025-09-17T21:02:50.641803Z"}, {"uuid": "ad8a1e7a-a6d0-4916-b05a-e31db27ae5a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lwsthjio3f23", "content": "", "creation_timestamp": "2025-08-20T06:48:08.272874Z"}, {"uuid": "06bddcb8-b569-4767-9893-518dca4b5845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/115061215891033628", "content": "", "creation_timestamp": "2025-08-20T13:00:25.041752Z"}, {"uuid": "988d0661-18ed-4983-9ae9-d3359b235837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://thehackernews.com/2025/08/pre-auth-exploit-chains-found-in.html", "content": "", "creation_timestamp": "2025-08-21T14:38:00.000000Z"}, {"uuid": "5fc33b60-9b35-4297-a8de-80afc4b33baa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115068722084002946", "content": "", "creation_timestamp": "2025-08-21T20:49:18.453848Z"}, {"uuid": "abe402cb-c3e5-490e-8aa0-abde5fca06d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-57788.yaml", "content": "", "creation_timestamp": "2025-08-20T11:45:33.000000Z"}, {"uuid": "1809bfd2-8508-4984-9a22-df10b595c1e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lwze4wwg5f2v", "content": "", "creation_timestamp": "2025-08-22T21:02:41.399963Z"}, {"uuid": "857a93e3-5502-4afe-9468-c912a14e94fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/220707d1-7e3e-4ed1-af30-61e39ddf5b1f", "content": "", "creation_timestamp": "2025-08-20T14:35:34.440648Z"}, {"uuid": "cea664a2-e715-4737-af33-a17e15d0ca49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "published-proof-of-concept", "source": "Telegram/0gaiKYhQg1bZLQkekjHFdNCvoAuKWeqjDBHNT2JYfVcHtw", "content": "", "creation_timestamp": "2025-08-21T19:01:04.000000Z"}, {"uuid": "99d293b9-b01c-4261-9759-cc1c13d5003b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-57788", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Sonny Macdonald\", \"Piotr Bazydlo\", \"remmons-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution exploit chain for Commvault,\\n          tracked as CVE-2025-57790 and CVE-2025-57791. A command-line injection permits unauthenticated\\n          access to the 'localadmin' account, which then facilitates code execution via expression\\n          language injection. CVE-2025-57788 is also leveraged to leak the target host name, which is\\n          necessary knowledge to exploit the remote code execution chain. This module executes in\\n          the context of 'NETWORK SERVICE' on Windows.\", \"disclosure_date\": \"2025-08-19\", \"fullname\": \"exploit/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791\", \"is_install_path\": true, \"mod_time\": \"2025-09-15 11:19:49 +0000\", \"name\": \"Commvault Command-Line Argument Injection to Traversal Remote Code Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/commvault_rce_cve_2025_57790_cve_2025_57791\", \"references\": [\"CVE-2025-57790\", \"CVE-2025-57791\", \"CVE-2025-57788\", \"URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_1.html\", \"URL-https://documentation.commvault.com/securityadvisories/CV_2025_08_2.html\", \"URL-https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:43.700305Z"}]}