# CVE-2025-67108: eProsima Fast-DDS improper certificate revocation validation

Source: https://junglewise.ai/threats/cve-2025-67108-eprosima-fast-dds-improper-certificate-revocation-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-23. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-67108 · Severity: critical · CVSS 10 · Published 2025-12-23

eProsima Fast-DDS is a software library used for real-time data communication in robotics, automotive, and industrial systems. A security flaw was found where the system fails to re-verify security certificates after an initial connection is made. This allows an attacker to use a temporary or expired certificate to maintain a permanent, unauthorized connection, potentially leading to the theft of sensitive data or unauthorized control of connected devices.

Technologies: [Eprosima Fast Dds](https://junglewise.ai/threats/technologies/fast-dds). Vendors: [Eprosima](https://junglewise.ai/threats/vendors/eprosima).

## Quick answers

**Is CVE-2025-67108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67108 being exploited in the wild.

**How severe is CVE-2025-67108?** Critical severity, with a CVSS score of 10, published 23 December 2025.

**Which products and versions are affected?** Eprosima Fast Dds 3.3.0.

**Is there a fix for CVE-2025-67108?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-67108 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-67108?** Check whether you run Eprosima Fast Dds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in eProsima Fast-DDS v3.3 due to improper validation of certificate expiration and revocation (CWE-298, CWE-370). The software utilizes OpenSSL's X509_verify_cert in PKIDH.cpp and is_validation_in_time in Permissions.cpp only during the initial handshake phase. Once a connection is established and permissions are granted, the system fails to perform continuous or periodic validation. A remote, unauthenticated attacker can exploit this by using a certificate with a short validity period to establish a session and continue communicating indefinitely after the certificate has expired or been revoked. This bypasses the DDS Security authentication mechanism and access controls.

## Affected products

- eProsima Fast-DDS 3.3.0

## Timeline

- 2025-12-23: disclosed: Vulnerability details and CVE assigned.
- 2025-12-23: advisory: NVD publication date.

## References

- [http://fast-dds.com/](http://fast-dds.com/)
- [https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913](https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913)
- [https://github.com/eProsima/Fast-DDS/blob/master/src/cpp/security/accesscontrol/Permissions.cpp](https://github.com/eProsima/Fast-DDS/blob/master/src/cpp/security/accesscontrol/Permissions.cpp)

## Related threats

- [eProsima Fast DDS stack exhaustion in DDSSQLFilter parser](https://junglewise.ai/threats/cve-2026-22591-eprosima-fast-dds-stack-exhaustion-in-ddssqlfilter-parser)
- [eprosima Fast DDS out-of-bounds read in DATA_FRAG processing](https://junglewise.ai/threats/cve-2026-22590-eprosima-fast-dds-out-of-bounds-read-in-data-frag-processing)
- [eProsima Fast-DDS integer overflow in DataFrag sub-message processing](https://junglewise.ai/threats/cve-2025-65865-eprosima-fast-dds-integer-overflow-in-datafrag-sub-message)
- [eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.](https://junglewise.ai/threats/cve-2025-63829-eprosima-fast-dds-v3-3-and-before-has-an-infinite-loop)