CVE-2025-67109

NVD	https://nvd.nist.gov/vuln/detail/CVE-2025-67109
CWE	https://cwe.mitre.org/data/definitions/298.html

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-67109

CWE

https://cwe.mitre.org/data/definitions/298.html

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Weakness

A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age.

Potential Mitigations

References

http://eclipse.com
https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28
https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/auth_utils.c#L84

Improper Validation of Certificate Expiration

Weakness

Potential Mitigations

References