Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the -localadmin parameter via the password field to bypass authentication and gain a privileged token.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)
id: ff0225a0-1d9a-4bae-ab26-6038b18bb6d4
status: experimental
description: |
    Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791.
    An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.
references:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-20
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
    - cve.2025-57791
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'qlogin'
            - ' -cs '
            - ' -localadmin'
            - ' -clp '
            - '_localadmin__'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains|all:
        - 'qlogin'
        - ' -cs '
        - ' -localadmin'
        - ' -clp '
        - '_localadmin__'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-clp` `-cs` `-localadmin` `_localadmin__` `qlogin` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`