A set of default debug user credentials is embedded in cleartext within BMC Control‑M/MFT versions 9.0.20 through 9.0.22. The presence of these credentials means that the application can be accessed without any password change until the patch is applied. This vulnerability allows an unauthenticated attacker to log into the debug interface of the MFT API. Based on the description, it is inferred that such access could potentially expose sensitive configuration data or internal logs, but the CVE does not explicitly state the extent of actions an attacker could perform beyond obtaining API access.

BMC Control‑M and MFT versions 9.0.20, 9.0.21, and 9.0.22 are affected by the hard‑coded credentials.

The CVSS score of 9.8 indicates critical severity, reflecting the high impact of unauthorized API access. The EPSS score is less than 1%, suggesting current exploitation is rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network access to the MFT API combined with the use of predictable default credentials, an inference drawn from the nature of the hard‑coded credentials described.