CVE-2025-67108

An error in the ticket/certificate revocation validation mechanism (CWE-298: Improper Validation of Certificate with Host Mismatch, CWE-370: Missing or Incorrect Error Handling for Certificate Revocation) causes revoked permissions or access tokens to not be properly verified. As a result, connections that should be rejected as invalid are accepted by DDS communication nodes. The vulnerability is located in the access control module (Permissions.cpp) of the Fast-DDS library. A remote attacker, without authentication and without user interaction, can exploit this flaw to establish unauthorized connections.

An attacker can establish unauthorized, unsecured connections to systems using Fast-DDS, gaining access to sensitive data transmitted over the DDS network and compromising the integrity of communication between system nodes.

Patches available from the vendor should be applied in accordance with the references. It is recommended to monitor the official eProsima Fast-DDS repository and vendor pages (eprosima.com, fast-dds.com) for current patch information. Until the patch is applied, consider restricting network access to DDS nodes and implementing network segmentation.

eProsima Fast-DDS v3.3