CVE-2025-67109

Katalog CVE

CVSS 10.0 · Critical EPSS 0,33%

Kerentanan Improper Validation of Certificate Expiration pada eclipse cyclone data distribution service. Skor CVSS 3.1 10.0 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Rincian

Terbit di NVD

23 Desember 2025

Terakhir diubah

5 Juli 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-298: Improper Validation of Certificate Expiration

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6 advisory pihak ketiga
• https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28 product
• https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/a... product