CVE-2025-67108: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-67108 is a certificate revocation validation vulnerability in eProsima Fast-DDS v3.3 that allows unauthenticated remote attackers to maintain insecure communications after certificate expiration. The flaw was disclosed on December 23, 2025, and affects specifically Fast-DDS version 3.3.0. It carries a CVSS v3.1 base score of 10.0 (Critical), assigned by CISA-ADP (NVD, Red Hat CVE).

The vulnerability is classified under CWE-298 (Improper Validation of Certificate Expiration) and CWE-370 (Missing Check for Certificate Revocation after Initial Check). Certificate expiration is verified only during the initial TLS handshake via OpenSSL's X509_verify_cert in PKIDH.cpp, and permission grant validity is checked via the is_validation_in_time function in Permissions.cpp (around line 263). Once a connection is established and permissions are granted, no continuous or periodic re-validation of certificate expiration occurs. An attacker can obtain a short-lived certificate, establish a legitimate connection, and then continue communicating after the certificate expires — effectively bypassing DDS Security access controls without any user interaction (GitHub Gist, Fast-DDS Source).

Successful exploitation allows an unauthorized network attacker to maintain persistent, insecure DDS communications after their certificate has expired or been revoked, violating the DDS Security specification's certificate authentication mechanism. This results in high confidentiality and integrity impact across all connected DDS participants within the same domain, with a changed scope indicating that the impact extends beyond the vulnerable component itself. Sensitive data exchanged over DDS topics may be exposed, and unauthorized participants could publish or subscribe to protected topics, enabling data manipulation or exfiltration in robotics, autonomous systems, or industrial control environments that rely on Fast-DDS (GitHub Gist, Red Hat CVE).

No public proof-of-concept exploit code has been confirmed as functional, though a PoC repository is referenced at https://github.com/lkloliver/poc/tree/main/CVE-2025-67108 (GitHub Gist). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.03% (0.000300), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Red Hat CVE).

1. Obtain a short-lived certificate: Acquire or generate a certificate with a brief validity window (e.g., minutes to hours) that is accepted by the target Fast-DDS v3.3 deployment's Permissions CA.
2. Establish a DDS connection: Use the valid certificate during the initial handshake phase to authenticate with the target DDS domain. Fast-DDS will verify the certificate via X509_verify_cert and check permission grant validity via is_validation_in_time — both pass at this stage.
3. Wait for certificate expiration: Allow the certificate's validity period to lapse. The established DDS session remains active because Fast-DDS does not perform continuous re-validation of certificate expiration post-handshake.
4. Continue unauthorized communication: Publish or subscribe to protected DDS topics, exfiltrate data, or inject malicious messages into the DDS domain using the now-expired but still-accepted session, bypassing security policies and access controls (GitHub Gist, Fast-DDS Source).

• Network: DDS RTPS traffic originating from participants whose certificates have passed their notAfter timestamp; unexpected DDS domain participant discovery messages from unknown or previously removed endpoints.
• Logs: Fast-DDS security logs showing successful participant authentication followed by absence of re-validation events over extended periods; no SecurityException entries for expired certificates after initial handshake.
• Process/Behavior: DDS participants remaining active and communicating on protected topics beyond the expected certificate lifetime; unexpected data publications or subscriptions on sensitive DDS topics from participants that should have been revoked.

As of the disclosure date, no official patch from eProsima has been confirmed as released; the patch status is listed as pending (Red Hat CVE). Recommended interim mitigations include: (1) isolating or disabling systems running Fast-DDS v3.3 where possible; (2) implementing strict network segmentation to limit DDS domain exposure; (3) using very short certificate validity windows combined with frequent manual session audits; (4) monitoring DDS network traffic for participants with expired certificates; and (5) applying official security patches from eProsima as soon as they become available. Organizations should monitor the eProsima Fast-DDS GitHub repository for patch releases.

The vulnerability received coverage from The Hacker Wire, which highlighted the bypass of ticket revocation in secure DDS communications (The Hacker Wire). Social media discussion was noted on Mastodon and Bluesky shortly after disclosure. Red Hat tracked the CVE as part of their security advisory process, indicating relevance to downstream consumers of Fast-DDS (Red Hat CVE). Tenable added detection support via Nessus plugin 279649 (Tenable).