Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows an unauthenticated attacker to impersonate legitimate users and access restricted functionality. This identity spoofing can lead to unauthorized control over distributed applications, potentially compromising confidentiality, integrity, and availability. The vulnerability is associated with CWE-306.

RTI Connext Professional is affected across multiple major releases: from 7.4.0 up to, but not including, 7.7.0; from 7.0.0 up to, but not including, 7.3.*; from 6.1.0 up to, but not including, 6.1.*; from 6.0.0 up to, but not including, 6.0.*; and from 5.3.0 up to, but not including, 5.3.*.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of < 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, involving unsecured interfaces or APIs that lack proper authentication checks. The risk remains moderate, but early mitigation is recommended to prevent potential identity spoofing scenarios.