CVE-2025-10450

Executive Summary

CVE-2025-10450 is a vulnerability in RTI Connext Professional, a widely used Data Distribution Service (DDS) middleware for real-time systems. The flaw allows an unauthorized actor to sniff network traffic, leading to the exposure of private personal information (PII) or other sensitive data transmitted over the network. The vulnerability affects Core Libraries in versions 7.2.0 up to (but not including) 7.3.1, and versions 7.4.0 up to (but not including) 7.7.0. The root cause is a lack of mandatory encryption or authentication enforcement for DDS discovery and data traffic, allowing passive eavesdropping. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. However, the impact is high for environments handling sensitive data.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary middleware library (RTI Connext Professional) distributed directly by RTI. Organizations should verify the integrity of their RTI software distribution channels and ensure they are receiving patched versions from official sources.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (AV:N) – The attacker can sniff traffic from the network.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (C:H) – Sensitive data (PII) is exposed.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): None (A:N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. While no active exploitation is reported, the ease of passive sniffing and the potential for sensitive data exposure make this a significant risk for organizations using affected versions in untrusted networks.

Deep Dive & Mechanics

The vulnerability resides in the RTI Connext Professional Core Libraries, specifically in the DDS (Data Distribution Service) implementation. DDS uses a publish-subscribe model where data writers and readers discover each other via the Simple Discovery Protocol (SDP) and then exchange data over the network.

Root Cause: The affected versions do not enforce mandatory encryption (e.g., DDS Security with RTI's built-in security plugins) or authentication for discovery and data traffic. By default, traffic may be sent in plaintext or with weak protection, allowing an attacker on the same network segment to passively capture packets.

Attack Vector:

1. The attacker gains access to the network segment where RTI Connext participants are communicating (e.g., via a compromised switch, ARP spoofing, or wireless eavesdropping).
2. The attacker uses a packet sniffer (e.g., Wireshark, tcpdump) to capture DDS traffic.
3. The attacker analyzes the captured packets to extract sensitive data (PII, control commands, sensor readings) that is transmitted without encryption.

Affected Components:

• rtiddsgen generated code (if not configured with security)
• rti_me (Micro Edition) and rti_connext_dds (Professional) libraries
• Discovery and data traffic over UDP/TCP

Vulnerable vs. Patched Code

Since this is a configuration/security policy issue rather than a code bug, the "patch" involves enabling DDS Security features. Below is a conceptual comparison.

Vulnerable Configuration (e.g., USER_QOS_PROFILES.xml):

<!-- No security configuration present -->
<qos_profile name="DefaultProfile">
    <domain_participant_qos>
        <!-- No security plugin defined -->
    </domain_participant_qos>
</qos_profile>

Patched Configuration (RTI Security Plugins enabled):

<qos_profile name="SecureProfile">
    <domain_participant_qos>
        <security>
            <governance>
                <url>file:///path/to/governance.xml</url>
            </governance>
            <permissions>
                <url>file:///path/to/permissions.xml</url>
            </permissions>
        </security>
    </domain_participant_qos>
</qos_profile>

Code-level fix (if using RTI Security Plugins):

// Vulnerable: No security setup
DDSDomainParticipant* participant = factory->create_participant(
    domain_id, DDS_PARTICIPANT_QOS_DEFAULT, NULL, DDS_STATUS_MASK_NONE);

// Patched: Enable security
DDS_DomainParticipantQos qos;
factory->get_default_participant_qos(qos);
// Load governance and permissions files
qos.security.governance.url = "file:///path/to/governance.xml";
qos.security.permissions.url = "file:///path/to/permissions.xml";
DDSDomainParticipant* participant = factory->create_participant(
    domain_id, qos, NULL, DDS_STATUS_MASK_NONE);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the same network segment as the target RTI Connext participants.
• A packet capture tool (e.g., Wireshark, tcpdump).
• (Optional) RTI Connext libraries to decode DDS traffic.

Steps:

1. Identify RTI Traffic: Use tcpdump to capture UDP traffic on common DDS ports (e.g., 7400, 7410, or dynamic ports).

   sudo tcpdump -i eth0 -w capture.pcap port 7400 or port 7410
   

2. Analyze with Wireshark: Open the capture file and filter for DDS protocols (e.g., dds or rtps).
3. Extract Data: Look for RTPS (Real-Time Publish-Subscribe) packets containing user data. If encryption is not enabled, the payload will be in plaintext.
4. Decode (if needed): Use RTI's rtiddsspy tool to subscribe to the same topics and dump data.

   rtiddsspy -domainId 0 -topicName "SensitiveTopic" -printSample
   

No public exploit code is available.

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized packet capture tools (e.g., tcpdump, Wireshark) on critical hosts.
• Use network monitoring to detect DDS traffic on unexpected ports or from unknown IPs.
• Enable DDS Security logging to detect authentication failures.

Prevention:

• Upgrade to patched versions (7.3.1 or 7.7.0+).
• Enforce DDS Security with encryption (AES-GCM) and authentication (DDS:X.509).
• Segment networks to isolate RTI traffic from untrusted hosts.
• Use TLS/DTLS tunnels for DDS traffic if security plugins are not feasible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unencrypted DDS/RTPS packets on UDP ports 7400, 7410, or dynamic ports.
  • Presence of rtiddsspy or rtiddsgen tools on unauthorized hosts.
  • ARP spoofing or MAC flooding on the network segment.
• Host IOCs:
  • Unauthorized packet capture tools (e.g., tcpdump, Wireshark) installed.
  • Suspicious processes named rtiddsspy or rtiddsgen.
• File IOCs:
  • Capture files (.pcap, .pcapng) in user directories.
  • Logs showing DDS security violations (if enabled).

Detection Engineering

YARA Rule

rule Detect_RTI_Connext_Unencrypted_Traffic {
    meta:
        description = "Detects unencrypted RTI Connext DDS traffic in pcap files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10450"
    strings:
        $rtps_magic = { 52 54 49 44 } // "RTID" in hex (RTPS magic number)
        $dds_plaintext = /[A-Za-z0-9_\-\.]{10,}/ // Potential plaintext data
    condition:
        $rtps_magic and #dds_plaintext > 5
}

Sigma Rule

title: Detection of Unencrypted RTI Connext DDS Traffic
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic indicative of unencrypted RTI Connext DDS communication.
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1040
    - cve.2025.10450
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 7400
            - 7410
        Protocol: UDP
    condition: selection
falsepositives:
    - Legitimate RTI Connext traffic with encryption enabled (if port is used)
level: medium

Suricata Rule

alert udp any any -> any 7400,7410 (msg:"CVE-2025-10450 - Unencrypted RTI Connext DDS Traffic Detected"; content:"|52 54 49 44|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to RTI Connext Professional version 7.3.1 or 7.7.0 (or later).
2. Enable DDS Security with encryption and authentication using RTI Security Plugins.
3. Segment networks to isolate RTI traffic from untrusted hosts.

Long-term Mitigations:

• Implement network monitoring for DDS traffic anomalies.
• Conduct regular security audits of DDS configurations.
• Use VPNs or IPsec tunnels for cross-network DDS communication.
• Apply the principle of least privilege to DDS topics and participants.

Patch Details:

• Upgrade to Connext Professional 7.3.1 (for 7.2.x users) or 7.7.0 (for 7.4.x users).
• No OSV or GitHub advisory is available; obtain patches directly from RTI support.

Valters IT