Critical severity · published Dec 23, 2025
CVE-2025-67109
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges
10.0
CVSS
0.3%
EPSS
No
On KEV
Description
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CD
Cyclone Data Distribution Service · Eclipse
before 0.10.5 · source: NVD
Affected product
CD
Cyclone Data Distribution Service
Eclipse
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67109
Third Party Advisory
https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
Product
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28
Product
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/auth_utils.c#L84
More from Cyclone Data Distribution Service
9.1
CVE-2024-10838
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory
7.5
CVE-2020-18735
A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash
7.5
CVE-2020-18734
A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash