CVE-2025-28389

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-28395.4The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versioCVE-2025-283957.1D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.CVE-2025-283987.1D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.CVE-2025-283999.8An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address ControlCVE-2025-28405.3The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclCVE-2025-284006.7An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit methodCVE-2025-284016.7An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameterCVE-2025-284029.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterCVE-2025-284037.2An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the reqCVE-2025-284059.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodCVE-2025-284069.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterCVE-2025-284078.8An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not proper
CVE-2025-28389: Critical severity, CVSS 9.8 | Vulnix