CVE-2025-55118

HighCVSS 8.9/10Last modified Jun 17, 2026

Description

Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured.

The issue occurs in the following cases:

* Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n"

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Weakness enumeration

CWE-122 CWE-125 CWE-191 CWE-415 CWE-416 CWE-665 CWE-787 CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-55129.8A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the fi CVE-2025-551235.4Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS att CVE-2025-551246.1Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.CVE-2025-551259.8This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configura CVE-2025-551266.5HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advert CVE-2025-551275.4HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new u CVE-2025-551286.5HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php CVE-2025-551295.4HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonatio CVE-2025-55135.4A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unkn CVE-2025-551309.1A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativ CVE-2025-551317.1A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module wit CVE-2025-551325.3A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process