EUVD-2025-18270CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Analysis
Critical remote code execution vulnerability in OpenC3 COSMOS v6.0.0's Plugin Management component that allows unauthenticated attackers to execute arbitrary code by uploading a specially crafted .txt file. The vulnerability has a CVSS score of 9.8 (critical severity) with no authentication or user interaction required, making it trivially exploitable over the network. Given the high CVSS score and attack surface (public-facing plugin management interfaces), this vulnerability poses an immediate threat to all deployed instances of the affected version.
Technical Context
The vulnerability exists in OpenC3 COSMOS's Plugin Management system (CPE: cpe:2.3:a:openc3:cosmos:6.0.0:*:*:*:*:*:*:*), which is a common operational technology (OT) and IT management platform. The root cause is classified under CWE-94 (Improper Control of Generation of Code - Code Injection), indicating that the plugin upload mechanism fails to properly sanitize or validate .txt file inputs before processing them. This likely stems from inadequate input validation in the file upload handler, where crafted .txt files containing executable code or commands are processed without sufficient security controls. The plugin management component likely uses an interpreter or code execution mechanism that blindly processes uploaded file contents, treating user-supplied data as trusted instructions rather than validating file structure and content.
Affected Products
COSMOS (6.0.0)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today