BMC Control-M/Agent CVE-2025-55114 IP Filtering Bypass Vulnerability Advisory

Critical Vulnerability Information Vulnerability ID CVE-2025-55114 Affected Versions Control-M/Agent 9.0.20 and earlier versions Vulnerability Description Issue: Incorrect IP address filtering order. Severity: Medium (5.3) Details: In Control-M/Agent, the Control-M/Server's IP address is validated only after the SSL/TLS handshake is completed. This exposes Control-M/Agent to vulnerabilities under certain non-default conditions (such as CVE-2025-55117 or CVE-2025-55118) or potential resource exhaustion scenarios. Remediation Primary Solution: Upgrade to a fully supported Control-M/Agent version (if the current version is no longer supported). BMC recommends upgrading to the latest major version and applying available patches. Alternative Solution: 1. Identify agents using SSL/TLS. - Open Control-M Configuration Manager (CCM). - If the SSL column is not visible, right-click any column header and select “Column chooser”. - In the Column chooser dialog, drag the “SSL” column into the column view. - Select each Control-M/Server in the left tree, and view the associated Control-M/Agents in the middle pane. - In the “Type” column header, set the filter to “Control-M Agent”. - Sort by the SSL column; any agent with SSL set to “Enabled” requires attention. - Create a file listing these agents by selecting the dropdown menu in the top-left corner and choosing “Export List”. 2. On each agent using SSL/TLS, run the following commands to determine which agents use the AUTHORIZED_CTM_IP parameter: - Windows: - UNIX/Linux: - If the above commands return no results, the agent is not affected and no further action is required. - Otherwise, consult with your network administrator to create firewall rules that allow only authorized Control-M/Server hosts to access the Server-to-Agent port.

Goal Reached Thanks to every supporter — we hit 100%!

BMC Control-M/Agent CVE-2025-55114 IP Filtering Bypass Vulnerability Advisory