PT-2025-37941 · Bmc · Control-M/Agent

Published 2025-09-16 · Updated 2025-09-29 · CVE-2025-55111

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Control-M/Agent versions 9.0.18 through 9.0.20

Description Files with overly permissive permissions were identified, potentially exposing keys and passwords related to SSL files, keystores, and policies. An attacker with local access to the system running the Agent can access these files.

Recommendations Control-M/Agent versions 9.0.18 through 9.0.20: Restrict file permissions to prevent unauthorized access to sensitive information such as SSL keys and passwords.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-55111

Affected Products

Control-M/Agent

References · 6

• https://osv.dev/vulnerability/CVE-2025-55111 · Vendor Advisory
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55111 · Security Note
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441965 · Vendor Advisory
• https://twitter.com/CVEnew/status/1967965140252495998 · Twitter Post
• https://t.me/cveNotify/136789 · Telegram Post