Cleartext Database Credentials in BMC Control-M Server

CVE-2025-48709

What is CVE-2025-48709?

A security vulnerability in BMC Control-M version 9.0.21.300 allows sensitive database connection details to be logged in cleartext. When the Control-M Server establishes a database connection, it executes DBUStatus.exe, which subsequently runs the dbu_connection_details.vbs script. This process inadvertently exposes the username, password, database hostname, and port in event and process logs. Such exposure may lead to unauthorized access and potential data breaches if not addressed promptly.

References