CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack

Critical · published June 13, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

🔥 Weak password requirements in OpenC3 COSMOS v6.0.0 make it surprisingly easy for attackers to crack your defenses with brute force! Think of it like a front door without a lock — anyone can waltz in just by trying a few keys. If your passwords are too simple, it's like handing out copies of your house keys to everyone at a party! An attacker could bypass all authentication measures, gaining unauthorized access to your system. This means they could view sensitive data, make unauthorized changes, or even take over your accounts entirely. It's a recipe for absolute chaos that could have devastating consequences for your security!

Put simply

Think of it like a front door without a lock — anyone can waltz in just by trying a few keys. If your passwords are too simple, it's like handing out copies of your house keys to everyone at a party! This vulnerability stems from weak password policies, allowing attackers to perform brute force attacks and easily guess user credentials. Essentially, the system fails to enforce strong, complex passwords, making it a breeze for intruders to gain access.

What to do

An attacker could bypass all authentication measures, gaining unauthorized access to your system. This means they could view sensitive data, make unauthorized changes, or even take over your accounts entirely. It's a recipe for absolute chaos that could have devastating consequences for your security! Immediately enforce strong password policies across your systems, requiring a mix of letters, numbers, and special characters. Additionally, consider implementing account lockout mechanisms after a set number of failed login attempts and review all access controls to tighten security. Don't forget to update OpenC3 COSMOS to the latest version to ensure you're fully protected! You've got this! With the right precautions, you'll fortify your defenses and keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00596 · 47.8th percentile
Published
2025-06-13T00:00Z
EPSS history
Timeline
  • 13 JUN 00:00Z
    Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack
    cvelistv5