PT-2025-45096 · Bmc · Bmc Control-M/Agent

CVE-2025-55108 · Publicado 2025-11-05 · Atualizado 2025-11-12

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Control-M/Agent (affected versions not specified)

Description The Control-M/Agent is susceptible to unauthenticated remote code execution, arbitrary file read and write, and other unauthorized actions when mutual SSL/TLS authentication is not enabled, which is the default configuration. The vendor indicates that this issue arises only when documented security best practices are not followed, specifically the configuration of SSL/TLS between the Control-M Server and Agent.

Recommendations Enable mutual SSL/TLS authentication to mitigate the risk. Configure SSL/TLS between Control-M Server and Agent, following the vendor's security best practices.

Correção

RCE

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2025-55108

Produtos afetados

Bmc Control-M/Agent

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-55108 · Nota de Segurança
• https://t.me/cveNotify/141781 · Publicação no Telegram
• https://twitter.com/gothburz/status/1988736390721355790 · Publicação no Twitter
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962 · Nota
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271 · Nota
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099 · Aviso do Fabricante
• https://t.me/CVEtracker/36605 · Publicação no Telegram
• https://twitter.com/cracbot/status/1987837699706036711 · Publicação no Twitter