CVE-2025-28384

CRITICAL EPSS 53.8%
Published Jun 13, 20251y ago · Modified Jun 17, 20261w ago
9.1 CVSS 3.1
Critical
Find Similar
Published Jun 13, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

CVSS Details

Base Score
9.1
Exploitability
3.9
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
53.8% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 2

VendorProductVersionRange
openc3cosmos6.0.0any
openc3cosmos6.0.0any

References 5

  • github.com https://github.com/OpenC3/cosmos/pull/1828
  • github.com https://github.com/OpenC3/cosmos/pull/1828/commits/fc7e11310a7cdf9f1939886e1b29009db4d4b718
  • github.com https://github.com/OpenC3/cosmos/releases/tag/v6.1.0
  • openc3.com https://openc3.com/
    Product
  • visionspace.com https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/
    ExploitMitigationThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.