Overview
OpenC3 COSMOS 6.0.0 users need to be aware of a severe vulnerability that has been recently identified – CVE-2025-28384. It’s a critical directory traversal issue that resides in the /script-api/scripts/ endpoint of the software. This vulnerability is of particular concern as it allows malicious attackers to execute directory traversal, potentially leading to system compromise or data leakage. Given the high CVSS Severity Score of 9.1, this issue should not be taken lightly and immediate preventative measures are crucial.
Vulnerability Summary
CVE ID: CVE-2025-28384
Severity: Critical (9.1 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
OpenC3 COSMOS | 6.0.0
How the Exploit Works
The exploit works by manipulating the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0. The attacker sends a specifically crafted request that contains directory traversal characters. In this case, OpenC3 COSMOS fails to properly sanitize the request, thereby allowing the attacker to gain unauthorized access to directories that should not be accessible. This could potentially reveal sensitive data or provide an opportunity for further attacks.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request that includes directory traversal characters in the request:
GET /script-api/scripts/../../../etc/passwd HTTP/1.1
Host: target.example.com
Content-Type: application/jsonThis request attempts to access the “/etc/passwd” file in the server, which contains sensitive information about user accounts.
Mitigation Guidance
It is advised to apply the vendor patch as soon as it is available. In the meantime, as temporary mitigation, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used to monitor and block suspicious requests to the vulnerable endpoint. Regular monitoring of system logs should also be carried out to detect any unauthorized attempts to access the system.