CVE-2025-55112

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-321 CWE-327

Affected software

Vendor	Product	Versions
BMC	Control-M/Agent	9.0.20; 9.0.19; 9.0.18

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441966Vendor Advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099Vendor Advisory

Timeline

Published: Sep 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-5511310.0If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions CVE-2025-551145.3The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the CVE-2025-551158.8A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent CVE-2025-551168.8A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agen CVE-2025-551175.3A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication i CVE-2025-551188.9Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the foll CVE-2025-55129.8A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the fi CVE-2025-551235.4Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS att CVE-2025-551246.1Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.CVE-2025-551259.8This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura CVE-2025-551266.5HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advert CVE-2025-551275.4HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new u