CVE-2025-48709

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48709

3.8 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

B

MC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.

References
Link Resource
https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ Vendor Advisory Mitigation
Configurations

Configuration 1 (hide)

cpe:2.3:a:bmc:control-m\/server:9.0.21.300:*:*:*:*:*:*:*
History

18 Dec 2025, 17:34

Type Values Removed Values Added
First Time Bmc
Bmc control-m\/server
CWE CWE-522
CPE cpe:2.3:a:bmc:control-m\/server:9.0.21.300:*:*:*:*:*:*:*
References () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - Vendor Advisory, Mitigation

01 Dec 2025, 22:15

Type Values Removed Values Added
Summary (en) An issue was discovered in BMC Control-M 9.0.21.300. When Control-M Server has a database connection, it runs DBUStatus.exe frequently, which then calls dbu_connection_details.vbs with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. (en) BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
CWE CWE-214
References
References () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ - () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/ -

27 Oct 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.8 		v2 : unknown
v3 : 3.8

16 Sep 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-07 20:15

Updated : 2025-12-18 17:34

NVD link : CVE-2025-48709

Mitre link : CVE-2025-48709

CVE.ORG link : CVE-2025-48709

JSON object : View

Products Affected

bmc

CWE
CWE-214

Invocation of Process Using Visible Sensitive Information

CWE-532

Insertion of Sensitive Information into Log File

CWE-522

Insufficiently Protected Credentials