Medium severity · published Sep 16, 2025
CVE-2025-55110
BMC Control-M/Agent hardcoded default keystore password
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented.
An attacker with read access to the keystore could access sensitive data using this password.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Control-M/Agent · BMC
9.0.22; 9.0.21; 9.0.20; 9.0.19; 9.0.18 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55110
bmcapps.my.site.com
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441964
bmcapps.my.site.com
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
More from Control-M/Agent
10.0
CVE-2025-55108
BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution
10.0
CVE-2025-55113
BMC Control-M/Agent unescaped NULL byte in access control list checks
9.0
CVE-2025-55109
BMC Control-M/Agent default SSL/TLS configuration authenticated bypass
8.9
CVE-2025-55118
BMC Control-M/Agent memory corruption in SSL/TLS communication
8.8
CVE-2025-55116
BMC Control-M/Agent buffer overflow local privilege escalation