Vulnerability Description
Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bmc | Control-M\/Agent | <= 9.0.20.200 |
Related Weaknesses (CWE)
References
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441966Vendor Advisory
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099Vendor Advisory
FAQ
What is CVE-2025-55112?
CVE-2025-55112 is a vulnerability with a CVSS score of 7.4 (HIGH). Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. ...
How severe is CVE-2025-55112?
CVE-2025-55112 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-55112?
Check the references section above for vendor advisories and patch information. Affected products include: Bmc Control-M\/Agent.