CVE-2025-67109

10.0 criticalEPSS 0.3%

Critical (10.0) in eclipse cyclone data distribution service. EPSS 0.3% chance of exploitation in the next 30 days.

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-298
Published: 2025-12-23
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Affected

eclipse:cyclone_data_distribution_service

References

https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/auth_utils.c#L84

Check your stack JSON