CVE-2025-55114

MEDIUM

BMC Control-M/Agent improper IP address filtering order

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-55114 has a selected CVSS score of 6.9 (medium).

Description

The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 16, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Control-M/Agent

Browse BMC / Control-M/Agent

Default status: affected

CVE List9.0.21unaffected
9.0.20affected
9.0.19affected
9.0.18affected

References

3