SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2025-48709

An authenticated attacker with shell access could observe these credentials and use them to log in to the database server.

MEDIUM 4.8EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.

CVSS 4.0
4.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS
0.13% probability · 2th percentile
CISA KEV
Not listed
Weakness
CWE-214, CWE-532, CWE-522
Affected
bmc/control-m\/server
Source
9119a7d8-5eab-497f-8521-727c672e3725

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.