Introduction
Unauthenticated attackers can remotely execute code, read or write arbitrary files, and perform unauthorized actions on BMC Control-M Agent installations if mutual SSL/TLS authentication is not enabled. The vulnerability, tracked as CVE-2025-55108, affects default deployments and can lead to complete compromise of critical automation infrastructure. BMC Control-M is a workload automation platform widely used in enterprises to run business-critical processes across industries. Its Agent component is deployed in thousands of organizations worldwide, so the impact on IT operations and security teams is significant.
Technical information
CVE-2025-55108 is a missing authentication vulnerability (CWE-306) in the BMC Control-M Agent that applies when mutual SSL/TLS authentication is not configured. By default, Control-M Agent does not enforce SSL/TLS or require mutual authentication for its communication with the Control-M Server. Any attacker who can reach the Agent over the network can therefore interact with it and perform privileged operations without authenticating.
Mechanism:
- The Agent listens for commands from the Control-M Server. Without SSL/TLS and mutual authentication (Security Level 4), it accepts and processes requests from any source.
- An attacker can send crafted protocol messages directly to the Agent's listening port (commonly 7005) to read or write arbitrary files or execute code with the privileges of the Agent process.
- Every default installation is vulnerable unless an administrator has explicitly configured SSL/TLS with mutual authentication and deployed proper certificates.
Root cause:
- The default configuration does not require authentication for critical functions between Control-M Server and Agent.
- The flaw comes from a design choice that put ease of deployment ahead of secure defaults, rather than from a software bug.
No public code snippets or PoC were available at the time of writing.
Patch information
BMC Software has released patches for multiple vulnerabilities in Control-M Agent versions 9.0.20.200 and earlier. They are tracked as CVE-2025-55108 through CVE-2025-55118 and include privilege escalation, information disclosure, and remote code execution issues.
The updated Control-M Agent releases fix the identified flaws, and users are strongly advised to upgrade to version 9.0.20.201 or later.
BMC's official documentation on its community portal has step-by-step upgrade instructions, covering pre-installation requirements, backup procedures, and post-installation verification. Follow the recommended procedure so the upgrade preserves the integrity and security of each Control-M Agent installation.
Patch reference: BMC Community Advisory
Affected systems and versions
- Product: BMC Control-M Agent
- Affected versions: 9.0.20.200 and earlier
- Vulnerable configurations: Default installations where mutual SSL/TLS authentication (Security Level 4) is not enabled between Control-M Server and Agent
Vendor security history
BMC Software has fixed authentication and privilege escalation vulnerabilities in Control-M Agent and related products before, and it has a history of publishing security advisories and patches for reported issues. For this vulnerability, BMC provided coordinated disclosure and detailed upgrade guidance. Insecure default configurations have come up in several earlier advisories, though, which is a reason to apply the recommended security settings at deployment instead of relying on the defaults.
