CVE-2025-55108

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-55108", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "state": "PUBLISHED", "assignerShortName": "airbus", "dateReserved": "2025-08-07T07:23:59.124Z", "datePublished": "2025-11-05T09:07:29.915Z", "dateUpdated": "2026-02-26T17:47:16.862Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Control-M/Agent", "vendor": "BMC", "versions": [{"status": "affected", "version": "9.0.22", "versionType": "semver"}, {"status": "affected", "version": "9.0.21", "versionType": "semver"}, {"status": "affected", "version": "9.0.20", "versionType": "semver"}, {"status": "affected", "version": "9.0.19", "versionType": "semver"}, {"status": "affected", "version": "9.0.18", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Airbus SAS - Jean-Romain Garnier - seclab@airbus.com"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).</div><br><div><p><i>NOTE:&nbsp;</i></p><ul><li><i>The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.</i><i><br></i></li><li><i>The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS</i></li></ul></div></div>"}], "value": "The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).\n\n\nNOTE:\u00a0\n\n * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.\n\n * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 9.5, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2025-11-18T12:33:27.896Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099"}, {"tags": ["mitigation"], "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962"}, {"tags": ["mitigation"], "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271"}], "source": {"discovery": "EXTERNAL"}, "title": "BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55108", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-06T04:55:31.617902Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:47:16.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55108", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-06T04:55:31.617902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:07:45.998Z"}}], "cna": {"title": "BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Airbus SAS - Jean-Romain Garnier - seclab@airbus.com"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BMC", "product": "Control-M/Agent", "versions": [{"status": "affected", "version": "9.0.22", "versionType": "semver"}, {"status": "affected", "version": "9.0.21", "versionType": "semver"}, {"status": "affected", "version": "9.0.20", "versionType": "semver"}, {"status": "affected", "version": "9.0.19", "versionType": "semver"}, {"status": "affected", "version": "9.0.18", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099", "tags": ["vendor-advisory"]}, {"url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962", "tags": ["mitigation"]}, {"url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271", "tags": ["mitigation"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).\n\n\nNOTE:\u00a0\n\n * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.\n\n * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS", "supportingMedia": [{"type": "text/html", "value": "<div><div>The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).</div><br><div><p><i>NOTE:&nbsp;</i></p><ul><li><i>The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.</i><i><br></i></li><li><i>The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS</i></li></ul></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "shortName": "airbus", "dateUpdated": "2025-11-18T12:33:27.896Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55108", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:47:16.862Z", "dateReserved": "2025-08-07T07:23:59.124Z", "assignerOrgId": "24a3c815-5f22-4d74-967a-30958d6466f4", "datePublished": "2025-11-05T09:07:29.915Z", "assignerShortName": "airbus"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Control-M/Agent", "vendor": "BMC", "versions": [{"status": "affected", "version": "9.0.22", "versionType": "semver"}, {"status": "affected", "version": "9.0.21", "versionType": "semver"}, {"status": "affected", "version": "9.0.20", "versionType": "semver"}, {"status": "affected", "version": "9.0.19", "versionType": "semver"}, {"status": "affected", "version": "9.0.18", "versionType": "semver"}]}], "source": "cert@airbus.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration).\n\n\nNOTE:\u00a0\n\n * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.\n\n * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS"}, {"lang": "es", "value": "El Control-M/Agent es vulnerable a ejecuci\u00f3n remota de c\u00f3digo no autenticada, lectura y escritura arbitraria de archivos y acciones no autorizadas similares cuando la autenticaci\u00f3n mutua SSL/TLS no est\u00e1 habilitada (es decir, en la configuraci\u00f3n predeterminada).\n\nNOTA: El proveedor cree que esta vulnerabilidad solo ocurre cuando no se siguen las mejores pr\u00e1cticas de seguridad documentadas. BMC siempre ha recomendado encarecidamente utilizar las mejores pr\u00e1cticas de seguridad como configurar SSL/TLS entre el Control-M Server y el Agent."}], "id": "CVE-2025-55108", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "cert@airbus.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cert@airbus.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55108", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-06T04:55:31.617902Z", "version": "2.0.3"}}]}, "published": "2025-11-05T09:15:32.170", "references": [{"source": "cert@airbus.com", "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962"}, {"source": "cert@airbus.com", "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099"}, {"source": "cert@airbus.com", "url": "https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271"}], "sourceIdentifier": "cert@airbus.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "cert@airbus.com", "type": "Secondary"}]}

{}

{"created": "2025-11-06T10:07:24.782476+00:00", "updated": "2025-11-06T10:07:24.782501+00:00", "vendors": ["bmc", "bmc$PRODUCT$control-m/agent"]}