What is the CVSS score of CVE-2025-63547?

CVE-2025-63547 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Micro-XRCE-DDS Agent are affected by CVE-2025-63547?

Eprosima Micro-XRCE-DDS Agent 3.0.1 contains a remote denial-of-service vulnerability that allows unauthenticated attackers to crash the agent via crafted network packets, potentially disrupting…

How to fix or mitigate CVE-2025-63547?

Within 24 hours: inventory all deployments of Eprosima Micro-XRCE-DDS Agent 3.0.1 and document network exposure; apply network segmentation to restrict DDS agent access to trusted peers only. Within 7 days: implement packet inspection rules to detect malformed MTU length fields targeting XRCE-DDS ports and deploy monitoring to detect unexpected agent restarts; contact Eprosima for patch timeline. Within 30 days: evaluate upgrade to patched version once released by vendor, or migrate to alternative DDS implementations if patch availability extends beyond acceptable risk window.

Micro-XRCE-DDS Agent CVE-2025-63547

EUVD-2025-209605 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-01 mitre

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 20:30 vuln.today

CVSS changed

May 01, 2026 - 19:22 NVD

7.5 (None) 7.5 (HIGH)

EUVD ID Assigned

May 01, 2026 - 18:00 euvd

EUVD-2025-209605

Analysis Generated

May 01, 2026 - 18:00 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field

AnalysisAI

Remote denial of service in Eprosima Micro-XRCE-DDS Agent 3.0.1 allows unauthenticated network attackers to crash the agent via malformed packets targeting the MTU length field. The vulnerability is remotely exploitable with no authentication required (CVSS AV:N/AC:L/PR:N/UI:N) and is classified as automatable by SSVC analysis. No active exploitation confirmed at time of analysis, but GitHub issue and researcher documentation provide technical details. EPSS data not available; CVSS 7.5 reflects high availability impact suitable for targeting DDS middleware deployments.

Technical ContextAI

Micro-XRCE-DDS is an implementation of the OMG DDS-XRCE protocol, a lightweight publish-subscribe middleware for resource-constrained devices and embedded systems. The Agent component acts as a bridge between XRCE clients and standard DDS networks. This vulnerability stems from improper input validation (CWE-400: Uncontrolled Resource Consumption) when processing the MTU (Maximum Transmission Unit) length field in incoming DDS-XRCE packets. Malformed MTU values can trigger resource exhaustion or crash conditions in the agent's packet parsing logic. The affected component handles network-level protocol framing, making it directly exposed to remote network traffic without requiring application-layer authentication.

RemediationAI

Primary remediation requires upgrading Micro-XRCE-DDS Agent to a patched version; specific fix version not identified in available data - consult GitHub issue https://github.com/eProsima/Micro-XRCE-DDS-Agent/issues/390 for resolution status and releases containing the fix. No vendor-released patch version independently confirmed at time of analysis. Interim mitigation: implement network-level access controls to restrict DDS agent exposure to trusted client networks only, blocking unauthenticated external access to the agent's listening port (default UDP/TCP ports per DDS-XRCE specification). Deploy agents behind firewalls with allowlisting of known-good client IP addresses. Trade-off: network restrictions prevent legitimate remote clients from connecting, limiting deployment flexibility in distributed IoT architectures. For production systems, combine ACLs with intrusion detection rules monitoring for malformed DDS-XRCE packets with anomalous MTU values. Monitor agent process health and implement automated restart policies to restore availability if DoS occurs, though this does not prevent the attack itself.