CVE-2025-48709

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48709
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.

3.8 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ Vendor Advisory Mitigation
Configurations

Configuration 1 (hide)

cpe:2.3:a:bmc:control-m\/server:9.0.21.300:*:*:*:*:*:*:*
History

18 Dec 2025, 17:34

Type Values Removed Values Added
First Time Bmc control-m\/server
Bmc
References () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - Vendor Advisory, Mitigation
CWE CWE-522
CPE cpe:2.3:a:bmc:control-m\/server:9.0.21.300:*:*:*:*:*:*:*

01 Dec 2025, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://bmc.com', 'source': 'cve@mitre.org'}
References () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ -
CWE CWE-214
Summary (en) An issue was discovered in BMC Control-M 9.0.21.300. When Control-M Server has a database connection, it runs DBUStatus.exe frequently, which then calls dbu_connection_details.vbs with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. (en) BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.

27 Oct 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 3.8

16 Sep 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 7.8

12 Aug 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Se detectó un problema en BMC Control-M 9.0.21.300. Cuando el servidor Control-M tiene una conexión a la base de datos, ejecuta DBUStatus.exe con frecuencia, lo que a su vez llama a dbu_connection_details.vbs con el nombre de usuario, la contraseña, el nombre de host de la base de datos y el puerto escritos en texto sin cifrar, lo cual se puede ver en los registros de eventos y procesos en dos ubicaciones distintas.
CWE CWE-532
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

07 Aug 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-07 20:15

Updated : 2025-12-18 17:34

NVD link : CVE-2025-48709

Mitre link : CVE-2025-48709

CVE.ORG link : CVE-2025-48709

JSON object : View

Products Affected

bmc

  • control-m\/server
CWE
CWE-214

Invocation of Process Using Visible Sensitive Information

CWE-532

Insertion of Sensitive Information into Log File

CWE-522

Insufficiently Protected Credentials