Openc3

Cosmos

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
10

CVE-2025-68271

  • EPSS 0.32%
  • Veröffentlicht 13.01.2026 18:32:21
  • Zuletzt bearbeitet 14.01.2026 16:25:40

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. Wh...

6.1

CVE-2025-28380

Exploit
  • EPSS 0.09%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 15:15:37

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

7.5

CVE-2025-28381

Exploit
  • EPSS 0.13%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

7.5

CVE-2025-28382

Exploit
  • EPSS 1.03%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

9.1

CVE-2025-28384

Exploit
  • EPSS 1.08%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

9.8

CVE-2025-28386

Exploit
  • EPSS 1.55%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 23.06.2025 14:06:04

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

9.8

CVE-2025-28388

Exploit
  • EPSS 0.17%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 27.10.2025 16:15:39

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

9.8

CVE-2025-28389

Exploit
  • EPSS 0.14%
  • Veröffentlicht 13.06.2025 00:00:00
  • Zuletzt bearbeitet 17.06.2025 19:42:06

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

6.5

CVE-2024-46977

  • EPSS 1.22%
  • Veröffentlicht 02.10.2024 20:15:11
  • Zuletzt bearbeitet 31.10.2024 14:15:05

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated user with adequate permissions...

6.5

CVE-2024-47529

Exploit
  • EPSS 0.93%
  • Veröffentlicht 02.10.2024 20:15:11
  • Zuletzt bearbeitet 13.11.2024 17:15:46

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password suscept...