CVE-2025-55112
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-10-10
Assigner: Airbus
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bmc | control-m\/agent | to 9.0.20.200 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and possibly earlier unsupported versions) that use the non-default Blowfish cryptography algorithm. These versions use a hardcoded cryptographic key, which means an attacker who has access to the network traffic and the key can decrypt the communication between the Control-M/Agent and the Server.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to decrypt sensitive network traffic between the Control-M/Agent and Server if they have access to the network and the hardcoded key. This can lead to exposure of confidential information and compromise the integrity and confidentiality of the communication.