CVE-2025-48709: BMC Control-M/Server cleartext database credentials in process lists and logs
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbuconnectiondetails.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48709?
CVE-2025-48709 is classified as a high severity vulnerability due to the exposure of sensitive information in cleartext.
How do I fix CVE-2025-48709?
To mitigate CVE-2025-48709, update BMC Control-M to version 9.0.21.307 or later as released by the vendor.
What type of information is exposed in CVE-2025-48709?
CVE-2025-48709 exposes database connection credentials including username, password, hostname, and port in cleartext.
Which software is affected by CVE-2025-48709?
CVE-2025-48709 affects BMC Control-M version 9.0.21.300 and potentially earlier versions.
How can the risk of CVE-2025-48709 be assessed in an organization?
The risk of CVE-2025-48709 can be assessed by reviewing database security practices and the handling of sensitive connection details.