CVE-2025-28388

In accordance with CWE-798, the vendor embedded static, unchangeable login credentials for a Service Account in the application code. An attacker who knows these hardcoded credentials (e.g., after analyzing the publicly available repository) can use them to authenticate to the system. Since these credentials are identical across all installations of a given version, the exploit requires no interaction from the victim or special privileges.

An attacker gains full, unauthorized access to the system with Service Account privileges, which may lead to disclosure of space mission data, modification of data, or complete disruption of the platform's operation.

OpenC3 COSMOS must be urgently updated to version 6.0.2 or later, in which the issue has been fixed. Patch details are available in the vendor's references (GitHub pull request #1816 and release v6.0.2). After updating, it is recommended to review access logs to detect any potential unauthorized use of the Service Account.

OpenC3 COSMOS in all versions before 6.0.2