eProsima Fast-DDS up to 3.1.1 data authenticity

Summaryinfo

A vulnerability was found in eProsima Fast-DDS up to 2.6.9/2.10.6/2.14.4/3.0.1/3.1.1. It has been declared as problematic. This issue affects some unknown processing. The manipulation results in data authenticity. This vulnerability is identified as CVE-2025-24807. The attack is only possible with local access. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in eProsima Fast-DDS up to 2.6.9/2.10.6/2.14.4/3.0.1/3.1.1. Affected is some unknown processing. The manipulation with an unknown input leads to a data authenticity vulnerability. CWE is classifying the issue as CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. This is going to have an impact on integrity, and availability. CVE summarizes:

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing `governance/permissions` from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-24807 since 01/23/2025. The exploitability is told to be easy. Local access is required to approach this attack. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 230800 (Linux Distros Unpatched Vulnerability : CVE-2025-24807), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.6.10, 2.10.7, 2.14.5, 3.0.2 or 3.1.2 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (230800). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• eProsima

Name

• Fast-DDS

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.10.0
• 2.10.1
• 2.10.2
• 2.10.3
• 2.10.4
• 2.10.5
• 2.10.6
• 2.14.0
• 2.14.1
• 2.14.2
• 2.14.3
• 2.14.4
• 3.0.0
• 3.0.1
• 3.1.0
• 3.1.1

Website

• Product: https://github.com/eProsima/Fast-DDS/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion