Critical severity · published Sep 16, 2025
CVE-2025-55113
BMC Control-M/Agent unescaped NULL byte in access control list checks
10.0
CVSS
0.3%
EPSS
No
On KEV
Description
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Control-M/Agent · BMC
9.0.22.000; 9.0.21; 9.0.20; 9.0.19; 9.0.18 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55113
Mitigation
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441967
Vendor Advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
More from Control-M/Agent
10.0
CVE-2025-55108
BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution
9.0
CVE-2025-55109
BMC Control-M/Agent default SSL/TLS configuration authenticated bypass
8.9
CVE-2025-55118
BMC Control-M/Agent memory corruption in SSL/TLS communication
8.8
CVE-2025-55116
BMC Control-M/Agent buffer overflow local privilege escalation
8.8
CVE-2025-55115
BMC Control-M/Agent path traversal local privilege escalation