A critical remote code execution vulnerability in OpenC3 COSMOS allows unauthenticated attackers to execute arbitrary Ruby code via the JSON-RPC API.

The vulnerability exists in the JSON-RPC API, where improper handling of string-to-value conversion leads to the execution of eval() on user-supplied input. This occurs during the command parsing phase, which executes before authorization checks are validated, allowing unauthenticated attackers to trigger the flaw.

The ability to execute arbitrary Ruby code allows an attacker to gain full control over the application server, potentially leading to complete data exfiltration, service disruption, or lateral movement within the network. With a perfect CVSS score of 10, this is a critical vulnerability that requires immediate attention to prevent total system compromise.

Immediate Action: Upgrade OpenC3 COSMOS to version 6.10.2 or later, which contains the necessary security fix for the JSON-RPC parsing logic.

Proactive Monitoring: Review API access logs for suspicious JSON-RPC payloads containing Ruby code patterns or unexpected string-to-value conversion attempts.

Compensating Controls: Restrict network access to the JSON-RPC API using IP whitelisting or by placing the service behind a VPN, preventing public exposure until the patch is applied.

Public Exploit Available: Not specified

This vulnerability is highly severe because it permits unauthenticated remote code execution. Administrators must prioritize updating to version 6.10.2 immediately to negate the risk of unauthorized system access.