CVE-2025-55109

BMC Control-M/Agent default SSL/TLS configuration authenticated bypass

Severity: Critical (9.0)

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default KDB keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authentication can bypass the need for a certificate signed by the certificate authority of the organization during authentication on the Control-M/Agent.

The Control-M/Agent contains hardcoded certificates which are only trusted as fallback if an empty KDB keystore is used; they are never trusted if a PKCS#12 keystore is used. All of these certificates are now expired.

In addition, the Control-M/Agent default kdb and PKCS#12 keystores contain trusted third-party certificates (external recognized CAs and default self-signed demo certificates) which are trusted for client authentication.

Determine which Control-M/Agents use SSL/TLS communication with Control-M/Server:

1. Open the Control-M Configuration Manager (CCM).
2. If the SSL column is not currently showing, right click on any column header and select "Column chooser."
3. From the Column chooser dialog, drag the "SSL" column into the columns view.
4. Select each Control-M/Server in the tree on the left to view the Control-M/Agents in the middle pane.
5. Sort by the SSL column, and any Agents set to "Enabled" will need to be handled.
6. As needed, export this list to a file: choose File -> Exports List

If SSL/TLS is not enabled, then the Agent is not affected by this specific CVE (CVE-2025-55109).

If SSL/TLS enabled, verify that SSL/TLS is configured according to the best practices in article 000442490.