CVE-2025-55109 BMC Control-M/Agent default SSL/TLS configuration authenticated bypass
Remote attackers can bypass authentication on BMC Control-M/Agent by using default or empty keystores with trusted third-party certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55109?
CVE-2025-55109 is a critical authentication bypass vulnerability in BMC Control-M/Agent, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authentication can bypass the need for a certificate signed by the certificate authority of the organization during authentication on the Control-M/Agent.
The Control-M/Agent contains hardcoded certificates which are only trusted as fallback if an empty kdb keystore is used; they are never trusted if a PKCS#12 keystore is used. All of these certificates are now expired.
In addition, the Control-M/Agent default kdb and PKCS#12 keystores contain trusted third-party certificates (external recognized CAs and default self-signed demo certificates) which are trusted for client authentication.
Weakness: CWE-295
Which versions are affected by CVE-2025-55109?
It affects 1 product.
Products include Bmc Control-M\/Agent.
How do I fix CVE-2025-55109?
No fix has been published for CVE-2025-55109 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-55109 being exploited?
There is no known exploitation of CVE-2025-55109 in the wild and no public exploit code.
Other vulnerabilities in BMC Control-M/Agent
- CVE-2025-55113 BMC Control-M/Agent unescaped NULL byte in access control list checks
- CVE-2025-55115 BMC Control-M/Agent path traversal local privilege escalation
- CVE-2025-55116 BMC Control-M/Agent buffer overflow local privilege escalation
- CVE-2025-55112 BMC Control-M/Agent hardcoded Blowfish keys
- CVE-2025-55117 BMC Control-M/Agent buffer overflow in SSL/TLS communication
Sources
Also known as GHSA-gh47-wqwg-v2cm.