CVE-2025-67109
Eclipse Cyclone Data Distribution Service ≤ 0.10.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-67109 is a critical-severity Improper Validation of Certificate Expiration (CWE-298) vulnerability in Eclipse Cyclone Data Distribution Service. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Subvert Trust Controls (T1553); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-67109 involves improper verification of the time certificate in Eclipse Cyclone DDS versions before v0.10.5. This vulnerability, classified under CWE-298, enables attackers to bypass certificate checks. Published on 2025-12-23, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe.
The attack scenario targets remote networks with low complexity, requiring no privileges, user interaction, or authentication. Attackers can exploit the flaw to circumvent certificate validation, achieving remote code execution with System privileges and causing high impacts to confidentiality, integrity, and availability across a changed scope.
References point to the Eclipse website at http://eclipse.com and a GitHub Gist at https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6, along with specific code locations in the CycloneDDS repository: src/ddsrt/src/time/posix/time.c#L28 and src/security/builtin_plugins/authentication/src/auth_utils.c#L84. These indicate the need to upgrade to v0.10.5 or later to address the improper verification.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204853
Vulnerability Data
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires proper issuance, distribution, and lifecycle handling of certificates used for authentication, directly stopping expiration validation omissions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication of services/hardware requires certificate validation including expiration checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing certificate expiration checks but does not constitute the control's full intent.
Cryptography policy requires proper certificate lifecycle management including expiration validation.
Secure coding practices can include certificate validation checks but do not address the control's broader scope.
Secure authentication mandates validation of certificate attributes such as expiration dates.