CVE-2025-68271 - CVE House
Back to Database
Status published Critical CVE-2025-68271

Unauthenticated Remote Code Execution in openc3-api

Vulnerability Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#convert_to_value. For array-like inputs, convert_to_value executes eval(). Because the cmd code path parses the command string before calling authorize(), an unauthenticated attacker can trigger Ruby code execution even though the request ultimately fails authorization (401). This vulnerability is fixed in 6.10.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68271

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenC3

View All →
CVE-2024-47529
OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
Medium 4.8
CVE-2024-46977
OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)
Medium 5.3
CVE-2024-43795
OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)
Medium 5.1

Affected Vendor

Affected Software

cosmos
Vulnerable Versions:
>= 5.0.0, < 6.10.2

Timeline

Official Publish: January 13th, 2026
Last Modified: January 13th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.