BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution

The impact of CVE-2025-55108 is severe due to the unauthenticated nature of the RCE. An attacker, without requiring any credentials, can exploit this vulnerability to gain complete control over the affected Control-M/Agent. This could involve executing malicious commands, stealing sensitive data stored on the system, or modifying system configurations. Successful exploitation could lead to lateral movement within the network if the agent has access to other systems or resources. The blast radius extends to any data processed or managed by the Control-M system, potentially impacting critical business operations and sensitive information. The vendor notes that this vulnerability is a direct consequence of not following their recommended security practices, specifically the use of mutual SSL/TLS authentication.

1. आरक्षित2025-08-07
2. प्रकाशित2025-11-05
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-55108 is to enable mutual SSL/TLS authentication between the Control-M Server and Agent. This requires configuring both the server and agent to verify each other's identities using certificates, preventing unauthorized connections. If immediate patching is not feasible, consider implementing strict network segmentation to isolate the Control-M/Agent from other critical systems. Web Application Firewall (WAF) rules can be configured to block suspicious traffic patterns associated with RCE attempts, although this is not a substitute for proper authentication. Monitor system logs for unusual activity or attempts to access files without proper authorization. After enabling mutual TLS authentication, verify the configuration by attempting to connect to the agent from an unauthorized source; the connection should be rejected.