CVE-2025-55111

EUVD-2025-29572 · Published Sep 16, 2025

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files.

Technologies

Linux Linux KernelBmc Control-M\/Agent

Weaknesses

CWE-276

CVSS scores

v4.05.7CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.15.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Execution Privilege Escalation Stealth Discovery

T1068Exploitation for Privilege Escalation T1083File and Directory Discovery T1574.010Services File Permissions Weakness

References

Potentially impacted assets

See if this affects your attack surface