CVE-2025-28388 Hardcoded credentials in n/a
Attackers can use hardcoded Service Account credentials to gain unauthorized access and escalate privileges in OpenC3 COSMOS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-28388?
CVE-2025-28388 is a critical vulnerability in n/a, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Weakness: CWE-798
Which versions are affected by CVE-2025-28388?
1 open source package ship an affected version, including openc3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openc3 PyPI | All versions to 6.0.0 | None |
Products include Openc3 Cosmos.
How do I fix CVE-2025-28388?
No fix has been published for CVE-2025-28388 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-28388 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28388 exists.
Other vulnerabilities in n/a
- CVE-2025-28386 Code injection in n/a
- CVE-2025-28389 Weak cryptography in n/a
- CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
- CVE-2026-42088 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool
- CVE-2025-28384 OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
Sources
Also known as GHSA-9c5p-pqv5-93v2, PYSEC-2025-258.