A critical code injection vulnerability in OpenC3 COSMOS allows authenticated users to execute arbitrary code, potentially compromising internal credentials and system data.

This vulnerability involves improper control of code generation (CWE-94) where authenticated non-administrator users can write content to the targets_modified directory. This content is subsequently executed by various microservices, including cmd-tlm-api and Script Runner, through insecure processing of configuration files and scripts.

The ability for a standard user to execute arbitrary code with the privileges of the underlying microservices presents a severe risk to organizational security. Successful exploitation could lead to full system compromise, the theft of sensitive internal credentials, and unauthorized access to telemetry data from embedded systems. Given the CVSS score of 9.9, this vulnerability is classified as critical and warrants immediate attention to prevent potential service disruption or data exfiltration.

Immediate Action: Upgrade OpenC3 cosmos to version 7.3.0 or later to apply the necessary security fixes for path handling and command execution.

Proactive Monitoring: Review system logs for unusual file write operations within the targets_modified directory and monitor microservice behavior for unexpected script execution or calls to external resources.

Compensating Controls: Restrict access to the OpenC3 platform to only essential personnel and implement network-level segmentation to isolate the COSMOS microservices from critical infrastructure until patching is completed.

Public Exploit Available: Unknown

The vulnerability in OpenC3 COSMOS represents a critical security failure that could lead to complete system takeover. Administrators should prioritize the update to version 7.3.0 across all instances immediately. Given the potential for lateral movement and credential theft, ensure that the environment is fully audited following the application of the patch to confirm no unauthorized persistent access was established during the window of exposure.