CVE-2025-55114CWE-696

BMC Control-M/Agent improper IP address filtering order

Medium · published September 16, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.6th percentile
Weakness
CWE-696 · Incorrect Behavior Order
Published
2025-09-16T12:20Z
EPSS history
Timeline
  • 16 SEP 12:20Z
    BMC Control-M/Agent improper IP address filtering order
    cvelistv5