CVE-2025-55114
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: Airbus
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bmc | control-m_agent | 9.0.20 |
| bmc | control-m_agent | 4.0 |
| bmc | control-m_agent | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-696 | The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to the improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent. Specifically, the Control-M/Server IP address is only validated after the SSL/TLS handshake is completed. This sequence flaw exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions or potentially to resource exhaustion.
How can this vulnerability impact me? :
The vulnerability can expose the Control-M/Agent to attacks exploiting weaknesses in the SSL/TLS implementation, which may lead to resource exhaustion or other security issues. This could affect the availability or stability of the affected system.