title: RTI Connext DDS Professional and Connext DDS Secure Network Amplification
description: RTI Connext DDS Professional, Connext DDS Secure versions 4.2x to 6.1.0, and Connext DDS Micro versions 2.4 and later are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic. This may result in a denial-of-service condition and information exposure.
problem types: CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
affected:
{
product: Connext DDS Professional
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
{
product: Connext DDS Secure
vendor: RTI
versions:
lessThanOrEqual: 6.1.0, status: affected, version: 4.2x, versionType: custom
}
{
product: Connext DDS Micro
vendor: RTI
versions:
lessThan: unspecified, status: affected, version: 2.4, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: RTI recommends users apply the available patches for these issues. A patch is available on the RTI customer portal or by contacting RTI Support. Also, contact RTI Support for mitigations, including how to use RTI DDS Secure to mitigate against the network amplification issue.