Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2025-55114

BMC Control-M/Agent improper IP address filtering order

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
airbus

Description

The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

BMC Control-M/Agent

Default version status: affected

  • 9.0.21unaffected
  • 9.0.20affected
  • 9.0.19affected
  • 9.0.18affected

References