CVE-2025-55113

When ACL execution is enabled in Control-M/Agent and the C router is active (default in end-of-support versions 9.0.18–9.0.20, and configurable in newer versions via JAVA_AR setting), verification of the email address in the client certificate terminates prematurely at the first NULL character (byte 0x00). An attacker can craft a certificate in which the email address contains a NULL byte in a strategic location, causing the system to read only the portion of the address before that byte. As a result, a truncated, potentially allowed address is verified, even though the certificate's actual identity is different — leading to ACL rule bypass.

An attacker can bypass configured ACL rules and gain unauthorized access to the Control-M/Agent instance, which may consequently lead to takeover of managed tasks, privilege escalation, and compromise of dependent systems.

Apply patches available from the vendor according to references (BMC Knowledge articles: sfdcid=000441967 and sfdcid=000442099). Additionally, in newer versions, verify the JAVA_AR setting and disable the C router if not essential. Versions under end-of-support (9.0.18–9.0.20) should be updated to a supported version as soon as possible.

BMC Control-M/Agent versions 9.0.18 to 9.0.20 (unsupported versions with C router enabled by default) and potentially earlier unsupported versions; newer versions are vulnerable if the C router was manually enabled via JAVA_AR setting