PT-2025-45096 · Bmc · Bmc Control-M/Agent

Published 2025-11-05 · Updated 2025-11-12 · CVE-2025-55108

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Control-M/Agent (affected versions not specified)

Description The Control-M/Agent is susceptible to unauthenticated remote code execution, arbitrary file read and write, and other unauthorized actions when mutual SSL/TLS authentication is not enabled, which is the default configuration. The vendor indicates that this issue arises only when documented security best practices are not followed, specifically the configuration of SSL/TLS between the Control-M Server and Agent.

Recommendations Enable mutual SSL/TLS authentication to mitigate the risk. Configure SSL/TLS between Control-M Server and Agent, following the vendor's security best practices.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-55108

Affected Products

Bmc Control-M/Agent

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-55108 · Security Note
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099 · Vendor Advisory
• https://t.me/cveNotify/141781 · Telegram Post
• https://twitter.com/gothburz/status/1988736390721355790 · Twitter Post
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962 · Note
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271 · Note
• https://t.me/CVEtracker/36605 · Telegram Post
• https://twitter.com/cracbot/status/1987837699706036711 · Twitter Post