Description (CNA)
The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| BMC / Control-M/Agent | unaffected 9.0.21; affected 9.0.20; affected 9.0.19; affected 9.0.18 |
CWE
CWE-696
References
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
- https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441968
ADP enrichment
No English description supplied.
No references supplied.