Which versions of Connext Professional are affected by CVE-2025-10450?

RTI Connext Professional versions 7.2.0 through 7.6.x contain a network traffic sniffing vulnerability that exposes private data to unauthorized remote actors, creating confidentiality risk for…. A patch is available.

How to fix or mitigate CVE-2025-10450?

Within 24 hours: identify all RTI Connext Professional deployments and document affected versions (7.2.0-7.3.0 and 7.4.0-7.6.x). Within 7 days: apply vendor-released patch to progress beyond affected version ranges; consult RTI security advisory for specific patched version designation. Within 30 days: verify patch deployment across all instances and validate traffic encryption/integrity controls are enforced.

Connext Professional CVE-2025-10450

Q: What is the CVSS score of CVE-2025-10450?

CVE-2025-10450 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2025-12-16 3f572a00-62e2-4423-959a-7ea25eff1638

Authentication Bypass Connext Professional

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 02:22 vuln.today

Patch released

Apr 01, 2026 - 02:22 nvd

Patch available

CVE Published

Dec 16, 2025 - 16:15 nvd

HIGH 8.3

DescriptionCVE.org

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1.

AnalysisAI

Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to unauthorized remote actors with low attack complexity. The vulnerability allows confidentiality breach (high impact) with limited integrity and availability impacts, affecting distributed data-sharing middleware used in critical infrastructure and industrial systems. EPSS exploitation probability is minimal (0.05%, 15th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis.

Technical ContextAI

RTI Connext Professional is a Data Distribution Service (DDS) middleware implementation used for real-time, mission-critical communications in aerospace, defense, healthcare, and industrial IoT systems. This vulnerability stems from CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), indicating inadequate protection of sensitive data transmitted over the network layer. The affected versions span two major release branches: 7.2.0 through 7.3.0 and 7.4.0 through 7.6.x. The CVSS 4.0 vector shows network-exploitable conditions (AV:N) with low complexity (AC:L) but requires present attack conditions (AT:P), suggesting timing or environmental factors affect exploitability. The vulnerability permits unauthorized actors to intercept DDS communication streams and extract confidential information without authentication (PR:N), potentially compromising data privacy in distributed real-time systems where Connext mediates machine-to-machine communications.

RemediationAI

Vendor-released patches are available: upgrade to RTI Connext Professional version 7.3.1 or later for the 7.2.x/7.3.x branch, or upgrade to version 7.7.0 or later for the 7.4.x/7.6.x branch. Organizations should consult the official RTI vulnerability advisory at https://www.rti.com/vulnerabilities/#cve-2025-10450 for patch download links, installation procedures, and compatibility notes. As an interim mitigation where immediate patching is not feasible, network segmentation can limit exposure by isolating Connext Professional communications to trusted network segments, implementing encrypted transport protocols for DDS traffic where supported, and deploying network monitoring to detect anomalous traffic patterns targeting DDS communication ports. Review and restrict network access to only authorized systems participating in DDS domains, and audit application configurations to ensure sensitive personal information is appropriately classified and protected with DDS security plugins if available in the deployment.