Connext Professional EUVD-2025-209595

Requires the target Connext Professional deployment to process XML input from attacker-controllable sources. Specific vulnerable scenarios include: applications that accept XML-formatted QoS profiles via network APIs, systems that dynamically load type definitions from XML files accessible to untrusted users, or DDS domains that parse configuration XML from external sources (file shares, HTTP endpoints, message queues). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network accessibility without authentication, suggesting the vulnerable XML parsing occurs in network-facing services without access controls. Exploitation is limited by whether the deployment architecture exposes XML processing endpoints to untrusted networks-systems using only hardcoded or administrator-controlled XML configurations in isolated environments are not exploitable remotely. SSVC 'automatable: no' assessment confirms exploitation requires reconnaissance to identify specific XML input vectors and tailored payload crafting for the target application's XML schema, not generic mass-scanning exploitation.

Real-world risk is moderate-to-high for internet-exposed or untrusted-network deployments, but lower for isolated operational technology (OT) environments. CVSS 8.8 indicates network-exploitable (AV:N), low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), which suggests straightforward exploitation against vulnerable parsers. However, SSVC framework provides important context: exploitation status is 'none' (no active exploitation confirmed), automatable is 'no' (requires attacker to craft context-specific XML payloads targeting the application's XML processing workflow), and technical impact is 'partial' (data exfiltration and DoS, but no remote code execution). EPSS data not provided, preventing probabilistic exploitation assessment. No CISA KEV listing confirms this is not being actively exploited in the wild. The contradiction between CVSS severity (8.8) and SSVC's 'partial impact' assessment reflects that while the vulnerability is technically severe, real exploitation requires the attacker to identify which XML endpoints process untrusted input and craft appropriate XXE payloads for the DDS middleware context. Risk is highest for Connext deployments that parse XML from external sources (network configuration files, remote QoS profiles, or user-supplied type definitions) and lowest for air-gapped systems processing only administrator-controlled XML. Missing data: no EPSS score available; exploitation complexity in DDS context not detailed in references; specific XML processing features vulnerable not enumerated.

An attacker identifies a Connext Professional deployment that accepts XML-formatted QoS profiles or type definitions over the network (common in dynamic DDS systems allowing runtime reconfiguration). The attacker crafts a malicious XML document containing an external entity declaration pointing to file:///etc/passwd (for data exfiltration) or a recursive entity definition (for denial of service). When the Connext Core Libraries parse this XML input, the vulnerable parser processes the external entity, either sending sensitive file contents to an attacker-controlled server via out-of-band HTTP requests or consuming excessive memory/CPU through entity expansion, causing the DDS application to crash or become unresponsive. No public proof-of-concept specific to Connext Professional exists at time of analysis, but XXE exploitation techniques are well-documented and readily adaptable to DDS middleware contexts.