The vulnerability arises from weak protection of stored password hashes in Control‑M/Enterprise Manager, allowing an attacker who obtains credential data to attempt offline password recovery. This flaw is classified as CWE-328 and carries a CVSS score of 5.6, indicating moderate severity. The potential impact is that compromised credentials could permit unauthorized access to the system or cascading attacks if those credentials are reused elsewhere.

BMC Control‑M/Enterprise Manager, specifically unsupported releases 9.0.20.x and potentially earlier unsupported versions. No supported versions are listed as affected.

The lack of an EPSS score and absence from CISA’s KEV catalog suggest a lower likelihood of widespread exploitation at this time, but the risk remains active for organizations still running the unsupported versions. An attacker would need to acquire the credential database or backups to carry out offline brute‑force attempts, a process that can be executed without network interaction. Once a hash is compromised, the attacker can recover the plaintext password using common password cracking tools, leading to system compromise if the credentials grant administrative or privileged access.