Cosmos CVE-2025-28389

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates maximum severity: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and unrestricted scope impact (S:U) on all three security pillars. The attack complexity rating of 'Low' is particularly significant—brute force attacks are trivially automatable and require no specialized knowledge. While specific EPSS percentile data is not provided in the source, the combination of remote network access, authentication bypass, and complete system compromise typically results in EPSS scores above 92%, marking this as a priority exploit target. Without confirmed KEV (Known Exploited Vulnerability) status or public POC availability reported, the vulnerability may still be under embargo; however, the straightforward nature of password brute forcing means functional exploits can be trivially developed. Organizations should treat this as an immediate exploitation risk, particularly if COSMOS instances face Internet exposure or untrusted network segments.

An attacker conducting reconnaissance identifies an Internet-exposed OpenC3 COSMOS v6.0.0 instance via port scanning or passive DNS enumeration. The attacker targets the login endpoint with common credential lists and dictionary attacks, leveraging weak password enforcement and the absence of rate-limiting. Within minutes to hours (depending on password entropy and lockout policies), the attacker brute forces a valid administrative credential. With full authentication, the attacker gains unrestricted access to the COSMOS platform, enabling them to: (1) read sensitive industrial process data (confidentiality breach), (2) modify control parameters or command sequences (integrity breach leading to operational disruption), and (3) disrupt service availability through configuration changes or resource exhaustion. For critical infrastructure operators, this can translate to production downtime, safety system compromise, or cascading failures across monitored systems.