CVE-2025-24807

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing `governance/permissions` from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.

• CWE-345

• https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L390-L396Product
• https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/accesscontrol/Permissions.cpp#L412Product
• https://github.com/eProsima/Fast-DDS/blob/2.6.9/src/cpp/security/authentication/PKIDH.cpp#L241Product
• https://github.com/eProsima/Fast-DDS/pull/5530Patch
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-w33g-jmm2-8983Vendor Advisory
• https://www.omg.org/spec/DDS-SECURITY/1.1/PDFRelated

Published

Feb 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24801GLPI is a free asset and IT management software package. An …8.8
• CVE-2025-24802Plonky2 is a SNARK implementation based on techniques from P…8.6
• CVE-2025-24803Mobile Security Framework (MobSF) is an automated, all-in-on…5.4
• CVE-2025-24804Mobile Security Framework (MobSF) is an automated, all-in-on…4.3
• CVE-2025-24805Mobile Security Framework (MobSF) is an automated, all-in-on…5.5
• CVE-2025-24806Authelia is an open-source authentication and authorization …2.3
• CVE-2025-24808Discourse is an open-source discussion platform. Prior to ve…3.1
• CVE-2025-2481The MediaView plugin for WordPress is vulnerable to Reflecte…6.1
• CVE-2025-24810Cross-site scripting vulnerability exists in Simple Image Si…4.8
• CVE-2025-24811A vulnerability has been identified in SIMATIC S7-1200 CPU 1…8.7
• CVE-2025-24812A vulnerability has been identified in SIMATIC S7-1200 CPU 1…7.1
• CVE-2025-24813Path Equivalence: 'file.Name' (Internal Dot) leading to Remo…9.8