PT-2025-38667 · Unknown · Cosmodiumcs Onlyrat

Unhingedazrael · Published 2025-09-21 · Updated 2025-09-24 · CVE-2025-10767

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions CosmodiumCS OnlyRAT versions prior to 3.3

Description A vulnerability exists in CosmodiumCS OnlyRAT. The connect/remote upload/remote download function within the main.py file of the Configuration File Handler component is affected. Manipulation of the configuration["PASSWORD"] argument can lead to OS command injection. The attack requires a local approach and is considered difficult to exploit. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 3.3: Address the OS command injection issue by sanitizing or validating the configuration["PASSWORD"] argument within the connect/remote upload/remote download function in the main.py file. As a temporary workaround, restrict access to the Configuration File Handler component.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-10767

Affected Products

Cosmodiumcs Onlyrat

References · 9

• 🔥 https://docs.google.com/document/d/1oq9YO831FbEDBI2BqNiW-7YA_kMzHJmMgy82F8f-L9g/edit?tab=t.0 · Exploit
• 🔥 https://docs.google.com/document/d/1oq9YO831FbEDBI2BqNiW-7YA_kMzHJmMgy82F8f-L9g/edit?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10767 · Security Note
• https://twitter.com/CVEnew/status/1969893049867366725 · Twitter Post
• https://twitter.com/SecAideInfo/status/1970794042213482583 · Twitter Post
• https://vuldb.com/?submit.648118 · Note
• https://vuldb.com/?ctiid.325123 · Note
• https://vuldb.com/?id.325123 · Note
• https://t.me/CVEtracker/33016 · Telegram Post