CVE-2025-55110

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented.

An attacker with read access to the keystore could access sensitive data using this password.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1392

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-551115.5Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentiCVE-2025-551127.4Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-dCVE-2025-5511310.0If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versionsCVE-2025-551145.3The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after theCVE-2025-551158.8A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the AgentCVE-2025-551168.8A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the AgenCVE-2025-551175.3A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication iCVE-2025-551188.9Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the follCVE-2025-55129.8A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the fiCVE-2025-551235.4Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attCVE-2025-551246.1Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.CVE-2025-551259.8This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura
CVE-2025-55110: Medium severity, CVSS 5.5 | Vulnix