EUVD-2026-27057
GHSA-wgx6-g857-jjf7
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionNVD
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
AnalysisAI
OpenC3 COSMOS password change functionality accepts valid session tokens in lieu of current passwords, enabling attackers with hijacked tokens to lock out legitimate users and maintain persistent access to compromised accounts including administrator accounts. Publicly available exploit code demonstrates the attack chain. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all OpenC3 COSMOS deployments and document current versions; restrict administrative access and review recent session token logs for anomalies. Within 7 days: Upgrade all instances to version 6.10.5 (for v6.x branch) or version 7.0.0-rc3 or later (for v7.x branch); validate successful patch deployment. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today