Cosmos EUVD-2025-18269

This vulnerability presents exceptional real-world risk across multiple dimensions: (1) CVSS Vector Analysis: AV:N (network-accessible with no special conditions), AC:L (no attack complexity), PR:N (no privileges required), UI:N (no user interaction needed), S:U (impact limited to COSMOS), with C:H/I:H/A:H indicating complete confidentiality, integrity, and availability compromise. (2) Exploitation Likelihood: Hardcoded credentials are trivially discoverable through reverse engineering, source code leaks, or repository analysis—EPSS scoring for this class typically exceeds 0.95. (3) KEV/Active Exploitation: Given this affects space operations software with a critical nature and simple exploitation path, this should be assumed actively exploited or soon to be exploited in targeted campaigns against space agencies and aerospace contractors. (4) SSVC Framework: Exploitation is straightforward (not complex), automatable via credential scanning, and technical impact is total system compromise—this rates as 'Critical' for immediate patching. (5) Real-World Priority: This is not a theoretical high-CVSS issue; it is genuinely critical because hardcoded credentials eliminate the primary defense layer (authentication) for a system managing critical space infrastructure.

An attacker performing reconnaissance on space agencies or aerospace contractors discovers an internet-exposed OpenC3 COSMOS instance (via Shodan, Censys, or similar). The attacker downloads the COSMOS installation package or gains access to source code repositories and extracts the hardcoded Service Account credentials using static analysis or reverse engineering—no specialized tools required. With these credentials, the attacker authenticates to the COSMOS API as the Service Account, which typically has elevated privileges for system operations. The attacker then: (1) exfiltrates telemetry data and command history; (2) injects malicious commands into spacecraft command sequences; (3) modifies telemetry streams to mask other attacks; (4) disrupts ground system operations by stopping critical processes or corrupting data. All of this occurs without any authentication prompt, IDS alert, or user interaction. The attack is fully automated and can be executed in minutes by any attacker with basic technical knowledge.