CVE-2025-55113
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.5
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.29%
- CWE
- CWE-158
- Published
- 2025-09-16
- Last modified
- 2026-03-12
Affected products
- BMC Control-M/Agent
- BMC Control-M/Agent
- BMC Control-M/Agent
- BMC Control-M/Agent
- BMC Control-M/Agent
Weakness type
Related vulnerabilities
- CVE-2026-76354 — Path Traversal through Search Head Clustering in Splunk Enterprise
- CVE-2026-70603 — Electron: shell.openPath path validation bypass via embedded null byte
- CVE-2026-47778 — Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
- CVE-2026-43895 — jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts
- CVE-2026-41256 — jq: Embedded NUL truncates top-level jq programs loaded with -f
- CVE-2026-43861 — mutt before 2.3.2 does not check for '\0' in url_pct_decode.
- CVE-2026-43859 — mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
- CVE-2026-33191 — free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error