CVE-2025-55113
📋 TL;DR
This vulnerability allows attackers to bypass Access Control Lists in Control-M/Agent by using specially crafted client certificates with NULL bytes in email addresses. Affected systems include Control-M/Agent versions 9.0.18 to 9.0.20 (default vulnerable) and potentially earlier unsupported versions, with newer versions vulnerable only when specific C router configuration is enabled.
💻 Affected Systems
- BMC Control-M/Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete ACL bypass allowing unauthorized access to sensitive job management systems, potentially leading to job manipulation, data exfiltration, or system compromise.
Likely Case
Unauthorized users gain access to Control-M/Agent management functions they should be restricted from, enabling job execution, modification, or monitoring.
If Mitigated
Limited impact with proper network segmentation and certificate validation controls in place.
🎯 Exploit Status
Requires attacker to obtain or create specially crafted client certificates with NULL bytes in email address fields. Certificate management and validation bypass required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check BMC advisories for specific patched versions
Vendor Advisory: https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441967
Restart Required: Yes
Instructions:
1. Review BMC advisory 000441967 for patched versions. 2. Apply the recommended patch for your Control-M/Agent version. 3. Restart Control-M/Agent services. 4. Verify ACL enforcement works correctly.
🔧 Temporary Workarounds
Disable C router configuration
allRemove or modify JAVA_AR setting to disable C router functionality in newer versions
Review JAVA_AR environment variable and remove C router configuration
Upgrade unsupported versions
allUpgrade from vulnerable unsupported versions (9.0.18-9.0.20) to supported versions
Follow BMC upgrade procedures for Control-M/Agent
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Control-M/Agent from untrusted networks
- Enhance certificate validation with additional checks for NULL bytes in certificate fields
🔍 How to Verify
Check if Vulnerable:
Check Control-M/Agent version and JAVA_AR configuration for C router usage. Versions 9.0.18-9.0.20 are vulnerable by default.Check Version:
Check Control-M/Agent version through Control-M Enterprise Manager or agent configuration filesVerify Fix Applied:
Test ACL enforcement with certificates containing NULL bytes in email addresses after patch application.📡 Detection & Monitoring
Log Indicators:
- Failed ACL checks followed by successful authentication with unusual certificate patterns
- Authentication attempts with certificates containing special characters
Network Indicators:
- Unexpected connections to Control-M/Agent management ports from unauthorized sources
SIEM Query:
Search for Control-M authentication events where certificate validation succeeded despite ACL restrictions