PT-2025-37943 · Bmc · Control-M/Agent

Published 2025-09-16 · Updated 2025-09-16 · CVE-2025-55113

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Control-M/Agent versions 9.0.18 through 9.0.20 Control-M/Agent versions prior to 9.0.18 (potentially earlier unsupported versions)

Description The Access Control List (ACL) enforcement in Control-M/Agent can be bypassed when the C router is in use. The verification process halts at the first NULL byte found within the email address contained in the client certificate. An attacker can exploit this behavior to circumvent configured ACLs by utilizing a specially crafted certificate.

Recommendations For Control-M/Agent versions 9.0.18 through 9.0.20, update to a newer, supported version. For Control-M/Agent versions prior to 9.0.18, update to a newer, supported version.

Fix

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2025-55113

Affected Products

Control-M/Agent

References · 6

• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55113 · Vendor Advisory
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55113 · Security Note
• https://twitter.com/CveFindCom/status/1967931322980020691 · Twitter Post
• https://twitter.com/CVEnew/status/1967965136934801877 · Twitter Post