CVE-2025-67109

CriticalCVSS 10.0/10Last modified Jul 5, 2026

Description

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-298

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2025
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-67114.9An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error condition CVE-2025-671117.5An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) vi CVE-2025-671129.8Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) CVE-2025-671139.8OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804 CVE-2025-671149.8Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware bef CVE-2025-671156.5A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804184 CVE-2025-67126.5MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked t CVE-2025-671246.8A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite ar CVE-2025-671254.4A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG CVE-2025-67136.5An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handl CVE-2025-671337.5An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component CVE-2025-671359.8Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay