EUVD-2025-18269CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Analysis
OpenC3 COSMOS versions before v6.0.2 contain hardcoded credentials embedded in the Service Account, allowing unauthenticated remote attackers to gain complete system compromise without any user interaction. This critical vulnerability has a CVSS score of 9.8 (critical severity) with a network attack vector, and given the nature of hardcoded credentials in a mission-critical space operations software, real-world exploitation risk is extremely high for organizations still running vulnerable versions.
Technical Context
OpenC3 COSMOS is a command and control software platform used for spacecraft operations, ground system automation, and telemetry processing. The vulnerability stems from CWE-798 (Use of Hard-Coded Credentials), a fundamental authentication flaw where Service Account credentials are embedded directly in the codebase, configuration files, or binary artifacts rather than being properly externalized and protected. This allows any attacker with network access to the COSMOS instance to extract and reuse these credentials, bypassing authentication mechanisms entirely. The hardcoded nature means credentials cannot be rotated per-deployment and affect all instances using the same codebase. CPE context suggests the vulnerable product is cpe:2.3:a:openc3:cosmos, with all versions prior to 6.0.2 affected.
Affected Products
COSMOS (All versions before 6.0.2)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today