CVE-2025-67108

CriticalCVSS 10.0/10Last modified Jul 5, 2026

Description

eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-298CWE-370

Affected software

No affected versions have been published.

Timeline

Published
Dec 23, 2025
Last modified
Jul 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-6710910.0Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and executCVE-2025-67114.9An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditionCVE-2025-671117.5An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) viCVE-2025-671129.8Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) CVE-2025-671139.8OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804CVE-2025-671149.8Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware befCVE-2025-671156.5A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804184CVE-2025-67126.5MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked tCVE-2025-671246.8A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arCVE-2025-671254.4A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONGCVE-2025-67136.5An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handlCVE-2025-671337.5An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component
CVE-2025-67108: Critical severity, CVSS 10.0 | Vulnix