EUVD-2025-18269Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
AnalysisAI
OpenC3 COSMOS versions before v6.0.2 contain hardcoded credentials embedded in the Service Account, allowing unauthenticated remote attackers to gain complete system compromise without any user interaction. This critical vulnerability has a CVSS score of 9.8 (critical severity) with a network attack vector, and given the nature of hardcoded credentials in a mission-critical space operations software, real-world exploitation risk is extremely high for organizations still running vulnerable versions.
Technical ContextAI
OpenC3 COSMOS is a command and control software platform used for spacecraft operations, ground system automation, and telemetry processing. The vulnerability stems from CWE-798 (Use of Hard-Coded Credentials), a fundamental authentication flaw where Service Account credentials are embedded directly in the codebase, configuration files, or binary artifacts rather than being properly externalized and protected. This allows any attacker with network access to the COSMOS instance to extract and reuse these credentials, bypassing authentication mechanisms entirely. The hardcoded nature means credentials cannot be rotated per-deployment and affect all instances using the same codebase. CPE context suggests the vulnerable product is cpe:2.3:a:openc3:cosmos, with all versions prior to 6.0.2 affected.
Share
External POC / Exploit Code
Leaving vuln.today