CVE-2025-24807: Fast DDS does not verify Permissions CA
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing governance/permissions from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24807?
The severity of CVE-2025-24807 is considered critical due to improper validation of permissions.
How do I fix CVE-2025-24807?
To fix CVE-2025-24807, upgrade to the latest versions above 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, or 3.2.0.
What systems are affected by CVE-2025-24807?
CVE-2025-24807 affects eprosima Fast DDS versions below 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0.
What kind of vulnerability is CVE-2025-24807?
CVE-2025-24807 is an access control vulnerability that lacks full chain validation and proper expiration date checks.
Is there a workaround for CVE-2025-24807?
There is no official workaround for CVE-2025-24807; upgrading to a patched version is the recommended action.