Outdated Control-M/Agent Vulnerabilities by BMC Software
CVE-2025-55111

5.7MEDIUM

Key Information:

Vendor

Bmc

Status
Control-m/agent
Vendor
CVE Published:
16 September 2025

What is CVE-2025-55111?

Certain versions of BMC Control-M/Agent exhibit insufficient file permission settings. This allows local users to access sensitive files containing SSL keys, passwords, and other critical security information. The vulnerability is present in out-of-support versions 9.0.18 to 9.0.20, and potentially earlier unsupported versions, as well as in later versions that have been upgraded from the affected ones. Proper mitigation strategies should be implemented to restrict access and protect sensitive data.

Affected Version(s)

Control-M/Agent 9.0.21

Control-M/Agent 9.0.20

Control-M/Agent 9.0.19

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
vendor-advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
mitigation

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SAS - Jean-Romain Garnier - [email protected]
.