Hardcoded Key Vulnerability in Control-M/Agent by BMC Software

CVE-2025-55112

What is CVE-2025-55112?

Certain older versions of Control-M/Agent by BMC Software, specifically those configured to utilize the non-default Blowfish cryptography algorithm, are vulnerable due to the presence of a hardcoded encryption key. This vulnerability arises in Control-M/Agent versions 9.0.18 to 9.0.20, along with possibly earlier unsupported releases. An attacker who gains access to network traffic and knows this hardcoded key can decrypt sensitive communications between the Control-M/Agent and its associated server, posing a significant security risk. Users are encouraged to review their configurations and follow provided mitigation strategies to safeguard their environments.

References