CVE-2025-55112

Summary

Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.

Affected Software

VendorProductVersion RangeStatus
BMCControl-M/Agent9.0.21unaffected
BMCControl-M/Agent9.0.20affected
BMCControl-M/Agent9.0.19affected
BMCControl-M/Agent9.0.18affected

Weaknesses

  • CWE-321: CWE-321 Use of Hard-coded Cryptographic Key
  • CWE-327: CWE-327 Use of a Broken or Risky Cryptographic Algorithm

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References