EUVD-2025-18281
GHSA-p67j-387g-75wc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents CRITICAL real-world risk across multiple dimensions: (1) The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-accessible, unauthenticated attack requiring no user interaction and low complexity, representing a worst-case attack scenario. (2) The high confidentiality and integrity impact (C:H/I:H) means attackers can exfiltrate sensitive data and modify critical files, particularly dangerous in COSMOS's mission-critical satellite command-and-control context. (3) Although specific EPSS or KEV (CISA Known Exploited Vulnerabilities) data is not provided in this query, the combination of unauthenticated network access, no complexity requirement, and file system access in a command-and-control platform makes this highly exploitable in practice. (4) The lack of availability impact (A:N) suggests the vulnerability does not enable denial of service, but confidentiality and integrity compromise alone are sufficient for critical severity. This is NOT a false-positive high-CVSS scenario; the attack vector is genuine and the real-world impact is severe. |
| Exploit ScenarioDerived | An attacker discovers that OpenC3 COSMOS is deployed on a network-facing server running version 5.x. The attacker probes the /script-api/scripts/ endpoint and discovers it accepts path parameters. They craft a request such as: GET /script-api/scripts/../../../../../../etc/passwd (or URL-encoded variant). The vulnerable endpoint fails to properly validate the path and returns the contents of /etc/passwd, confirming arbitrary file read. The attacker then uses PUT/POST methods to traverse to writable directories and uploads a malicious script or modifies critical configuration files. In a satellite command-and-control context, this could lead to unauthorized command execution, exfiltration of mission parameters, or injection of false commands. The attack requires no authentication, no user interaction, and can be automated, making it a high-probability exploit scenario for internet-facing COSMOS instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical directory traversal vulnerability in OpenC3 COSMOS versions before 6.1.0 affecting the /script-api/scripts/ endpoint. An unauthenticated attacker can exploit this flaw over the network with no user interaction required to read and potentially write arbitrary files on the affected system, achieving high confidentiality and integrity impact. The vulnerability has a CVSS score of 9.1 (Critical) with an CVSS vector indicating network-based attack, low complexity, and no privilege requirements.
RemediationAI
Vendor Patch: Upgrade OpenC3 COSMOS to version 6.1.0 or later; priority: IMMEDIATE; details: The vendor has released version 6.1.0 which addresses the directory traversal vulnerability in the /script-api/scripts/ endpoint through input validation and path canonicalization improvements. Temporary Mitigation: Restrict network access to the /script-api/scripts/ endpoint; priority: HIGH; details: Implement network-level access controls (firewall rules, WAF) to limit who can reach the affected endpoint. Allow only trusted internal networks or specific IP addresses to access COSMOS API endpoints until patching is possible. Temporary Mitigation: Disable the /script-api/scripts/ endpoint if not in use; priority: HIGH; details: If the script API is not actively required, disable or deactivate the endpoint at the application or reverse proxy level to eliminate the attack surface. Monitoring: Monitor logs for suspicious path traversal patterns; priority: MEDIUM; details: Search COSMOS API logs for requests containing '../', '..\', URL-encoded sequences (%2e%2e, %252e), or other path traversal indicators targeting the /script-api/scripts/ endpoint. Assessment: Audit file system exposure; priority: HIGH; details: Determine which files could be accessed via path traversal (sensitive configs, credentials, source code). Conduct forensic analysis if systems were exposed prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'), a class of flaws where an application fails to properly validate or sanitize user-supplied path parameters. In OpenC3 COSMOS, the /script-api/scripts/ REST API endpoint processes user input related to script file paths without adequate canonicalization or boundary checking. An attacker can inject path traversal sequences (e.g., '../', '..\', or encoded variants) to navigate outside the intended script directory and access the broader filesystem. OpenC3 COSMOS is a mission-critical command and control software platform used for satellite operations and complex distributed system management (CPE: cpe:2.3:a:openc3:cosmos:*:*:*:*:*:*:*:*). The affected versions range from versions prior to 6.1.0, suggesting this is a recently patched issue in the COSMOS product line.
Know when Cosmos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2025-28384) exists in OpenC3 COSMOS versions before 6.1.0 that allows unauthenticated attackers to execute arbitrary commands through directory traversal. Organizations running affected versions face immediate risk of system compromise, data theft, and operational disruption, with active exploit code already in the wild.
Implement network segmentation to restrict access to the /script-api/scripts/ endpoint to trusted internal sources only. Deploy WAF rules to block or sanitize requests containing directory traversal patterns (../, ..\) targeting the /script-api/scripts/ endpoint. Disable script execution functionality if not operationally critical. Enable enhanced logging and monitoring on OpenC3 COSMOS systems for detection of exploitation attempts. Run affected systems with minimal privileges and in isolated network zones until patching is possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Critical remote code execution vulnerability in OpenC3 COSMOS v6.0.0's Plugin Management component that allows unauthent
OpenC3 COSMOS versions before v6.0.2 contain hardcoded credentials embedded in the Service Account, allowing unauthentic
Critical authentication bypass vulnerability in OpenC3 COSMOS v6.0.0 caused by weak password requirements that enable br
Directory traversal vulnerability in OpenC3 COSMOS versions before 6.1.0 that allows unauthenticated remote attackers to
A security vulnerability in OpenC3 COSMOS (CVSS 7.5) that allows attackers. Risk factors: public PoC available.
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scri
Privilege escalation in OpenC3 COSMOS allows low-privileged authenticated users to bypass API authorization and perform
SQL injection in OpenC3 COSMOS 6.7.0 to 7.0.0-rc2 allows authenticated users with minimal 'tlm' (telemetry viewer) privi
Authenticated OS command injection in OpenC3 COSMOS 5.12.0 through 7.2.1 allows a user with a valid session to run arbit
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
OpenC3 COSMOS password change functionality accepts valid session tokens in lieu of current passwords, enabling attacker
OpenC3 COSMOS versions 5.0.6 through 7.2.x contain a stored cross-site scripting flaw in the shared-screen BUTTON widget
Exploit-DB