CVE-2023-50257: Disconnect Vulnerability in RTPS Packets Used by SROS2

Published Feb 19, 2024
·
Updated

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (p[UD]) and guid values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (p[UD]), to the Global Data Space (239.255.0.1:7400) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the SecurityManager.cpp code (init, onprocesshandshake) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7.

Affected Software

5 affected components
eProsima Fast DDS
eProsima Fast DDS<2.6.7
eProsima Fast DDS>=2.10.0<2.10.3
eProsima Fast DDS>=2.11.0<2.11.3
eProsima Fast DDS>=2.12.0<2.12.2

Event History

Feb 19, 2024
CVE Published
via MITRE·07:22 PM
Data Sourced
via MITRE·07:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2023-50257?

The severity of CVE-2023-50257 is rated as critical due to the potential for data exposure between nodes.

2

How do I fix CVE-2023-50257?

To fix CVE-2023-50257, update eProsima Fast DDS to version 2.14.0 or later which addresses the encryption issue.

3

What versions of Fast DDS are affected by CVE-2023-50257?

CVE-2023-50257 affects eProsima Fast DDS versions from 2.6.7 up to but not including 2.13.0.

4

What impact does CVE-2023-50257 have on data security?

CVE-2023-50257 impacts data security by failing to encrypt critical values used for node disconnection.

5

Is there a workaround for CVE-2023-50257 if I cannot update immediately?

Currently, there are no official workarounds for CVE-2023-50257 and upgrading to a fixed version is recommended.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203