Improper AUTHORIZED_CTM_IP Validation in Control-M/Agent by BMC Software
CVE-2025-55114

6.9MEDIUM

Key Information:

Vendor

Bmc

Status
Control-m/agent
Vendor
CVE Published:
16 September 2025

What is CVE-2025-55114?

The Control-M/Agent by BMC Software exhibits a vulnerability due to the improper sequence of AUTHORIZED_CTM_IP validation. This flaw occurs because the validation of the Control-M/Server IP address is performed only after the SSL/TLS handshake is completed. As a result, the Control-M/Agent is susceptible to vulnerabilities in its SSL/TLS implementation under specific non-default conditions, such as related vulnerabilities (e.g., CVE-2025-55117 and CVE-2025-55118). Furthermore, this situation could lead to potential resource exhaustion, threatening the overall integrity and reliability of the system.

Affected Version(s)

Control-M/Agent 9.0.21

Control-M/Agent 9.0.20

Control-M/Agent 9.0.19

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
vendor-advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
mitigation

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SAS - Jean-Romain Garnier - [email protected]
.