CVE-2025-28389

The system does not enforce sufficiently strong passwords (CWE-521), allowing users to set passwords vulnerable to automated dictionary attacks or brute force attacks. An attacker can remotely and without any prior privileges systematically attempt successive password combinations until successfully logging into the victim's account.

A successful brute force attack allows an attacker to take control of a user or administrator account, resulting in complete compromise of the confidentiality, integrity, and availability of the OpenC3 COSMOS system.

Patches available from the vendor should be applied in accordance with the references. Additionally, it is recommended to enforce strong password policies in the organization's security policy and implement account lockout mechanisms after a specified number of failed login attempts.

OpenC3 COSMOS v6.0.0