Cosmos CVE-2025-28386

This vulnerability presents CRITICAL real-world risk across multiple threat dimensions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates Network attack vector with Low complexity, No privilege requirements, and No user interaction—this is the most dangerous profile possible. The vulnerability is unauthenticated and requires minimal attacker effort, making it immediately and widely exploitable. While specific EPSS and KEV (CISA Known Exploited Vulnerabilities) status data was not provided, the technical characteristics suggest high exploitation likelihood: the attack surface is large (network-accessible), the barrier to exploitation is low (file upload), and the impact is total system compromise. Organizations running OpenC3 COSMOS v6.0.0 should treat this as a P0/Critical priority requiring immediate patching. The vulnerability is not a 'high-CVSS-but-low-real-risk' issue; all signals align to indicate genuine, immediate, and severe threat.

An attacker identifies a publicly exposed OpenC3 COSMOS v6.0.0 instance running the Plugin Management interface. The attacker crafts a malicious .txt file containing Python, shell commands, or other executable code (e.g., reverse shell payload). The attacker navigates to the plugin upload interface and uploads the crafted .txt file without authentication. The Plugin Management system processes the .txt file content and executes the embedded code with the privileges of the COSMOS application process. The attacker gains remote code execution on the target system, allowing them to read sensitive operational technology data, modify control systems, establish persistence, or pivot to connected infrastructure. Due to the AV:N/AC:L/PR:N/UI:N characteristics, this attack requires no special reconnaissance and can be automated for mass exploitation of vulnerable instances.