CVE-2025-55114 - CVE House
Back to Database
Status published Medium CVE-2025-55114

BMC Control-M/Agent improper IP address filtering order

Vulnerability Description

The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55114

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Airbus SAS - Jean-Romain Garnier - seclab@airbus.com

References

More from BMC

View All →
CVE-2025-55118
BMC Control-M/Agent memory corruption in SSL/TLS communication
High 8.4
CVE-2025-55117
BMC Control-M/Agent buffer overflow in SSL/TLS communication
Medium 6.3
CVE-2025-55116
BMC Control-M/Agent buffer overflow local privilege escalation
Critical 9.3
CVE-2025-55115
BMC Control-M/Agent path traversal local privilege escalation
Critical 9.3
CVE-2025-55113
BMC Control-M/Agent unescaped NULL byte in access control list checks
Critical 9.5

Affected Vendor

Affected Software

Control-M/Agent
Vulnerable Versions:
9.0.21, 9.0.20, 9.0.19, 9.0.18

Timeline

Official Publish: September 16th, 2025
Last Modified: September 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-696

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.