Vulnerability Details CVE-2025-67109
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 25.7%
CVSS Severity
CVSS v3 Score 10.0
References
- http://eclipse.com
- https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
- https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28
- https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/auth_utils.c#L84
Products affected by CVE-2025-67109
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.1.0
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.10.1
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.10.2
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.10.3
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.10.4
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.5.0
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.5.1
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.6.0
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.7.0
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.8.0
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.8.1
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.8.2
-
cpe:2.3:a:eclipse:cyclone_data_distribution_service:0.9.0