Executive brief
Eclipse Cyclone DDS, a software library used for high-performance data communication in robotics and automotive systems, contains a critical security flaw in how it verifies digital certificates. An attacker can bypass security checks by manipulating the system time, allowing them to present expired or invalid credentials as legitimate. If successfully exploited, this could allow an unauthorized user to take full control of the system and execute arbitrary commands with high-level privileges.
Technical details
Eclipse Cyclone DDS before v0.10.5 is vulnerable to certificate validation bypass (CWE-298) due to its reliance on manipulable system time for expiration checks. The 'dds_time' function in 'time.c' utilizes 'clock_gettime(CLOCK_REALTIME)', which returns the system wall clock time rather than a trusted monotonic or external time source. Consequently, the 'check_certificate_expiry' function in 'auth_utils.c' and OpenSSL's 'X509_cmp_current_time' use this adjustable time to validate certificates. An attacker who can influence the system clock can force the library to accept expired or future-dated certificates, leading to authentication bypass and remote code execution with System privileges. The issue is addressed in version 0.10.5.
Affected products
- Eclipse Cyclone DDS before 0.10.5
Timeline
- 2025-12-23: advisory
- 2025-12-23: disclosed
- 2026-01-06: patched: NVD enrichment confirms versions before 0.10.5 are affected.