CVE-2025-55108
Nov. 18, 2025, 3:16 p.m.
9.5
Critical
Description
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).
NOTE:
* The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.
* The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS
Product(s) Impacted
| Product | Versions |
|---|---|
| control-m_agent |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Tags
CVSS Score
CVSS Data - 4.0
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Attack Requirements: PRESENT
- Privileges Required: NONE
- User Interaction: NONE
- Scope:
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
- Exploit Maturity: NOT_DEFINED
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Published: Nov. 5, 2025, 9:15 a.m.
Last Modified: Nov. 18, 2025, 3:16 p.m.
Last Modified: Nov. 18, 2025, 3:16 p.m.
Status : Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
More infoSource
cert@airbus.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.