CVE-2025-67109

moderate-risk
Published 2025-12-23

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 2cdd114cbd18340c606573b4cc8dc20cc161ec5a
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Cyclone Data Distribution Service

Affected Vendors

Eclipse

References (4)

Product http://eclipse.com
Third Party Advisory https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
Product https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/...
Product https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builti...
38
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal