EUVD-2025-18268
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
Analysis
Critical authentication bypass vulnerability in OpenC3 COSMOS v6.0.0 caused by weak password requirements that enable brute force attacks. An unauthenticated remote attacker can exploit this with no user interaction to gain full control over the affected system, including confidentiality, integrity, and availability compromise. The CVSS 9.8 severity and network-based attack vector indicate this poses significant risk to any organization running the vulnerable version without additional protective controls.
Technical Context
The vulnerability stems from CWE-521 (Weak Password Requirements), a foundational authentication weakness that fails to enforce sufficient password complexity, length, or entropy standards. In OpenC3 COSMOS v6.0.0, the authentication mechanism likely permits passwords with minimal complexity constraints (e.g., no length minimum, no character diversity requirements, or trivial default credentials), making the system susceptible to systematic password enumeration attacks. The absence of robust rate-limiting or account lockout mechanisms (common in weak authentication schemes) exacerbates the risk. This affects the COSMOS industrial control system platform, specifically CPE identifiers matching 'openc3:cosmos:6.0.0', which is widely deployed in critical infrastructure monitoring and orchestration environments.
Affected Products
COSMOS (['6.0.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today