CVE-2025-25373
Published: 25 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-25373 is a critical vulnerability in the Memory Management Module of NASA's Core Flight System (cFS) Aquila, stemming from insecure permissions (CWE-732). Published on 2025-03-25, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote code execution (RCE) on the affected platform.
The vulnerability can be exploited by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation enables arbitrary code execution on the cFS Aquila platform, resulting in high-impact compromise of confidentiality, integrity, and availability.
Advisories and further details are available at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a remote unauthenticated RCE vulnerability in a network-accessible Memory Management Module, directly enabling exploitation of public-facing applications for arbitrary code execution and initial access.