PT-2025-52762 · Eclipse · Eclipse Cyclonedds

Lkloliver · Published 2025-12-23 · Updated 2026-01-06 · CVE-2025-67109

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Cyclone DDS versions prior to 0.10.5

Description A flaw exists in Eclipse Cyclone DDS that involves improper verification of the time certificate. This allows attackers to bypass certificate checks and potentially execute commands with System privileges.

Recommendations Update to version 0.10.5 or later.

Fix

Weakness Enumeration

CWE-298

Related Identifiers

CVE-2025-67109

Affected Products

Eclipse Cyclonedds

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-67109 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67109 · Vendor Advisory
• https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28 · Note
• https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/security/builtin_plugins/authentication/src/auth_utils.c#L84 · Note
• http://eclipse.com · Note
• https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6 · Note
• https://twitter.com/cracbot/status/2005232331637043560 · Twitter Post
• https://twitter.com/CVEnew/status/2003567315598639389 · Twitter Post
• https://t.me/CVEtracker/40506 · Telegram Post
• https://t.me/cveNotify/147875 · Telegram Post