Cyber Posture

CVE-2025-25372

HighPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
30 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0067 71.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-25372 is a vulnerability in NASA's Core Flight System (cFS) Aquila version that leads to a segmentation fault. It affects the Memory Management Module, which can be triggered by sending a malicious telecommand. The issue is categorized under CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting and sending a malicious telecommand to the Memory Management Module, the attacker can induce a segmentation fault, causing the affected cFS Aquila instance to crash and resulting in a denial-of-service condition.

Mitigation details and further assessment are available in the advisory published by VisionSpace at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/. The CVE was published on 2025-03-25.

Details

CWE(s)
CWE-787

Affected Products

nasa
core flight system
6.7.0

MITRE ATT&CK Enterprise Techniques

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The vulnerability enables remote exploitation of the Memory Management Module via a crafted telecommand, triggering an out-of-bounds write that causes a segmentation fault and system crash, directly facilitating Endpoint Denial of Service through application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References