Vulnerability · Published Sep 16, 2025 · Assigned by airbus
CVE-2025-55112BMC Control-M/Agent hardcoded Blowfish keys
High 7.4
In plain English
A high-severity broken cryptography in Control-M/Agent from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BMC | Control-M/Agent | 9.0.209.0.199.0.18 |
Weakness: CWE-321, CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N