PT-2025-25416 · Openc3 · Openc3 Cosmos

Published 2025-06-13 · Updated 2025-10-27 · CVE-2025-28388

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0

Description The issue is related to hardcoded credentials for the Service Account.

Recommendations For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique, secure credentials to mitigate the risk of unauthorized access.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-28388

Affected Products

Openc3 Cosmos

References · 12

• 🔥 https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework · Exploit
• https://osv.dev/vulnerability/CVE-2025-28388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28388 · Security Note
• https://github.com/OpenC3/cosmos/pull/1816 · Note
• https://github.com/OpenC3/cosmos/releases/tag/v6.0.2 · Note
• https://github.com/OpenC3/cosmos/pull/1816/commits/195974a019f375f7c5a35f48e4151babb40649ac · Note
• https://t.me/latest_high_impact_cve/2650 · Telegram Post
• https://t.me/cvetracker/26191 · Telegram Post
• https://t.me/cveNotify/140494 · Telegram Post
• https://twitter.com/SpaceCyberSec/status/1933796767612744012 · Twitter Post
• https://twitter.com/CVEnew/status/1933528782972846489 · Twitter Post
• https://openc3.com · Note