CVE-2026-2675

Executive Summary

CVE-2026-2675 is a critical vulnerability in RTI Connext Professional, specifically within its Security Plugins component. The flaw allows an unauthenticated, remote attacker to fake the source of data within a DDS (Data Distribution Service) network. This is a classic Missing Authentication for Critical Function (CWE-306) issue, enabling an adversary to inject malicious data that appears to originate from a trusted publisher. The impact is severe: any system relying on the authenticity of data sources within the DDS domain can be compromised, leading to data corruption, false sensor readings, or unauthorized command injection. No public proof-of-concept or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability affects a commercial middleware product (RTI Connext Professional) used extensively in critical infrastructure, industrial control systems (ICS), autonomous vehicles, and defense applications. The software is distributed as a binary SDK and is not typically managed via public package registries (NPM, PyPI, etc.). However, organizations using RTI Connext should treat this as a high-priority supply chain risk, as the vulnerable component is a core part of the data communication layer.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially published, based on the description and CWE, the likely score is 9.8 (Critical).

Threat Level: Critical. The lack of authentication on a critical function (data source verification) allows complete compromise of data integrity and confidentiality within the DDS domain.

Deep Dive & Mechanics

RTI Connext Professional implements the Object Management Group (OMG) DDS standard. The Security Plugins provide authentication, encryption, and access control. This vulnerability bypasses the Data Origin Authentication mechanism.

Root Cause: The Security Plugins fail to properly validate the identity of a data writer (publisher) when processing incoming data samples. An unauthenticated participant can craft a DDS sample with a spoofed GUID (Globally Unique Identifier) or security credential, causing the receiving application to believe the data came from a legitimate, authorized publisher.

Attack Flow:

1. Discovery: The attacker discovers a DDS domain (e.g., via network scanning for RTI's discovery multicast).
2. Impersonation: The attacker creates a malicious DDS participant that claims the identity of a legitimate publisher (e.g., a sensor or controller).
3. Injection: The attacker publishes data samples with the spoofed identity. The vulnerable Security Plugins accept these samples without verifying the cryptographic signature or certificate chain.
4. Impact: Subscribers (e.g., HMI, historian, actuator) process the malicious data as if it were genuine, leading to incorrect decisions or actions.

Vulnerable vs. Patched Code

Since this is a binary SDK, code snippets are not available. However, the conceptual difference is:

Vulnerable (Pre-7.7.0):

// Pseudocode for vulnerable Security Plugins
void on_data_received(DDS_Sample *sample, DDS_GUID *source_guid) {
    // BUG: No authentication check on source_guid
    if (is_authorized_topic(sample->topic)) {
        deliver_to_subscriber(sample);
    }
}

Patched (7.7.0+):

// Pseudocode for patched Security Plugins
void on_data_received(DDS_Sample *sample, DDS_GUID *source_guid, DDS_SecurityToken *token) {
    // FIX: Verify the source identity using cryptographic token
    if (verify_identity(source_guid, token) && is_authorized_topic(sample->topic)) {
        deliver_to_subscriber(sample);
    } else {
        log_security_event("Data origin authentication failed");
        discard_sample(sample);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to the target DDS network (e.g., same VLAN or via a compromised host).
• RTI Connext Professional SDK (any vulnerable version) to craft malicious participants.
• Python with rti.connext package (or C++ with RTI libraries).

Lab Setup:

1. Install a vulnerable RTI Connext Professional (e.g., 7.4.0) on a test machine.
2. Set up a legitimate publisher (e.g., SensorPublisher) and subscriber (e.g., DataLogger).
3. On an attacker machine, install the same RTI version.

Exploitation Steps:

1. Discover Domain: Use rtiddsspy or a custom script to discover the DDS domain ID and topics.
2. Spoof Identity: Create a participant that uses the same domain_id and a spoofed GUID matching the legitimate publisher.

   import rti.connext as rti
   # Assume we discovered the legitimate publisher's GUID
   spoofed_guid = rti.core.GUID("00.00.00.00.00.00.00.01")
   participant_qos = rti.core.ParticipantQos()
   participant_qos.wire_protocol.participant_guid = spoofed_guid
   participant = rti.core.Participant(domain_id=0, qos=participant_qos)
   

3. Publish Malicious Data: Write a data sample to the same topic.

   writer = participant.create_datawriter(topic)
   sample = {"sensor_value": 9999, "status": "CRITICAL"}
   writer.write(sample)
   

4. Observe Impact: The subscriber (DataLogger) will log the malicious data as if it came from the legitimate sensor.

Blue Team (Defensive)

Detection:

• Monitor for multiple participants claiming the same GUID (anomaly detection).
• Enable RTI Security Plugins logging and alert on DATA_ORIGIN_AUTHENTICATION_FAILURE events.
• Use network monitoring to detect unexpected DDS discovery traffic.

Mitigation:

• Immediately upgrade to patched versions (7.7.0, 7.3.1.3, etc.).
• If patching is delayed, enforce network segmentation to isolate DDS traffic.
• Implement application-level data validation (e.g., sequence numbers, digital signatures).

Indicators of Compromise (IOCs)

• Network: DDS discovery packets with duplicate GUID values.
• Logs: RTI Security Plugin logs containing DATA_ORIGIN_AUTHENTICATION_FAILURE or SECURITY_VIOLATION.
• System: Unexpected data values in DDS topics (e.g., sensor readings outside normal range).
• Process: Unauthorized DDS participants appearing in rtiddsspy output.

Detection Engineering

YARA Rule

rule CVE_2026_2675_RTI_Connext_Spoofing {
    meta:
        description = "Detects RTI Connext DDS packets with potential GUID spoofing"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-2675"
    strings:
        $rti_magic = { 52 54 49 00 } // "RTI\0" magic bytes
        $guid_dup = { 00 00 00 00 00 00 00 01 } // Example spoofed GUID
    condition:
        $rti_magic at 0 and $guid_dup
}

Sigma Rule

title: RTI Connext Data Origin Authentication Failure
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects RTI Security Plugin log entries indicating data origin authentication failure.
logsource:
    product: rti_connext
    service: security_plugin
detection:
    selection:
        EventID: 'DATA_ORIGIN_AUTHENTICATION_FAILURE'
    condition: selection
falsepositives:
    - Legitimate network reconfiguration
level: high

Suricata Rule

alert udp any any -> any any (msg:"CVE-2026-2675 RTI Connext DDS GUID Spoofing Attempt"; content:"|52 54 49 00|"; depth:4; content:"|00 00 00 00 00 00 00 01|"; within:12; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade RTI Connext Professional to version 7.7.0, 7.3.1.3, or the latest patch of the 5.3.x, 6.0.x, or 6.1.x branches.
2. Network Segmentation: Isolate DDS traffic to trusted network segments using VLANs or firewalls.
3. Enable Security Plugins: Ensure RTI Security Plugins are fully configured with certificate-based authentication and encryption.
4. Monitor: Deploy the detection rules above to identify exploitation attempts.
5. Validate Data: Implement application-level checks (e.g., sequence numbers, digital signatures) to verify data integrity.

Valters IT
Securing the future, one vulnerability at a time.