BMC Control-M/Agent 9.0.18/9.0.19/9.0.20 certificate validation

Summaryinfo

A vulnerability classified as critical was found in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20. This affects an unknown part. Executing a manipulation can lead to certificate validation. This vulnerability is handled as CVE-2025-55109. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in BMC Control-M and Agent 9.0.18/9.0.19/9.0.20 and classified as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authentication can bypass the need for a certificate signed by the certificate authority of the organization during authentication on the Control-M/Agent. The Control-M/Agent contains hardcoded certificates which are only trusted as fallback if an empty kdb keystore is used; they are never trusted if a PKCS#12 keystore is used. All of these certificates are now expired. In addition, the Control-M/Agent default kdb and PKCS#12 keystores contain trusted third-party certificates (external recognized CAs and default self-signed demo certificates) which are trusted for client authentication.

The advisory is shared for download at bmcapps.my.site.com. This vulnerability was named CVE-2025-55109 since 08/07/2025. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 9.0.21 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-29574). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• BMC

Name

• Agent
• Control-M

Version

• 9.0.18
• 9.0.19
• 9.0.20

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion