CVE-2025-28389 Weak cryptography in n/a
Weak password requirements in OpenC3 COSMOS allow attackers to bypass authentication via brute force attacks, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-28389?
CVE-2025-28389 is a critical vulnerability in n/a, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
Weakness: CWE-521
Which versions are affected by CVE-2025-28389?
1 open source package ship an affected version, including openc3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openc3 PyPI | All versions to 6.0.0 | None |
Products include Openc3 Cosmos.
How do I fix CVE-2025-28389?
No fix has been published for CVE-2025-28389 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-28389 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28389 exists.
Other vulnerabilities in n/a
- CVE-2025-28386 Code injection in n/a
- CVE-2025-28388 Hardcoded credentials in n/a
- CVE-2026-42087 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
- CVE-2026-42088 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool
- CVE-2025-28384 OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
Sources
Also known as GHSA-g4xp-7879-36gf, PYSEC-2025-150.