Vulnerability · Published Sep 16, 2025 · Assigned by airbus
CVE-2025-55114BMC Control-M/Agent improper IP address filtering order
Medium 5.3
In plain English
A medium-severity security flaw in Control-M/Agent from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BMC | Control-M/Agent | 9.0.209.0.199.0.18 |
Weakness: CWE-696 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L