CVE-2025-55114: BMC Control-M/Agent improper IP address filtering order
The improper order of AUTHORIZEDCTMIP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55114?
CVE-2025-55114 has been rated as a critical vulnerability due to the improper validation of AUTHORIZED_CTM_IP in the Control-M/Agent.
How do I fix CVE-2025-55114?
To fix CVE-2025-55114, ensure that the AUTHORIZED_CTM_IP validation is correctly implemented before completing the SSL/TLS handshake.
Which software is affected by CVE-2025-55114?
CVE-2025-55114 affects BMC Control-M/Agent software.
What are the potential risks associated with CVE-2025-55114?
The risks associated with CVE-2025-55114 include exposure to vulnerabilities in the SSL/TLS implementation under non-default conditions.
Is CVE-2025-55114 being actively exploited?
At this time, there is no public information indicating that CVE-2025-55114 is being actively exploited in the wild.