CVE-2025-55109
📋 TL;DR
An authentication bypass vulnerability in Control-M/Agent allows remote attackers to authenticate using expired demo or third-party certificates instead of organization-signed certificates when default keystores are used. This affects out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions.
💻 Affected Systems
- Control-M/Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Control-M/Agent allowing unauthorized job execution, data access, and potential lateral movement within the environment.
Likely Case
Unauthorized access to Control-M/Agent for job manipulation, data exfiltration, or privilege escalation within the automation environment.
If Mitigated
Limited impact if proper certificate management and network segmentation are implemented, restricting access to authorized certificates only.
🎯 Exploit Status
Exploitation requires access to signed third-party or demo certificates and network access to Control-M/Agent. The hardcoded certificates are expired but may still be accepted in some configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A - versions are out-of-support
Vendor Advisory: https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441963
Restart Required: Yes
Instructions:
1. Upgrade to supported Control-M/Agent version (9.0.21 or later). 2. Replace default keystores with organization-specific keystores. 3. Remove trusted third-party certificates from keystores. 4. Restart Control-M/Agent services.
🔧 Temporary Workarounds
Replace Default Keystores
allReplace empty/default kdb and PKCS#12 keystores with organization-specific keystores containing only trusted organization certificates.
# Replace keystore files in Control-M/Agent installation directory
# Location varies by OS and installation method
Remove Third-Party Certificates
allRemove all third-party and demo certificates from keystores, leaving only organization-signed certificates.
# Use keytool or openssl to manage keystore contents
# keytool -delete -alias <cert-alias> -keystore <keystore-file>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Control-M/Agent from untrusted networks
- Deploy certificate pinning or client certificate validation at network perimeter devices
🔍 How to Verify
Check if Vulnerable:
Check Control-M/Agent version and keystore configuration. Verify if using default/empty keystores or if keystores contain third-party/demo certificates.Check Version:
# On Control-M/Agent host: ctmagent -v or check installation directory version filesVerify Fix Applied:
Verify keystores contain only organization-signed certificates and no third-party/demo certificates. Test authentication with organization certificates only.📡 Detection & Monitoring
Log Indicators:
- Authentication attempts using non-organization certificates
- Failed certificate validation for expected organization CAs
- Unexpected successful authentications
Network Indicators:
- SSL/TLS connections using demo or third-party certificates to Control-M/Agent ports
- Unusual authentication patterns
SIEM Query:
source="control-m" AND (certificate_validation="failed" OR certificate_issuer="demo" OR certificate_issuer="third-party")