CVE-2026-42084
Published: 04 May 2026
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the…
more
old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
Security SummaryAI
CVE-2026-42084 affects OpenC3 COSMOS, an open-source platform for sending commands to and receiving data from embedded systems. The vulnerability resides in the password change functionality in versions prior to 6.10.5 and 7.0.0-rc3, where users can update their password without providing the current one, relying solely on a valid session token for authentication. This flaw, classified under CWE-620 (Unverified Password Change), carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts.
An attacker with low privileges (PR:L) who has already obtained a valid session token—such as through prior account compromise—can exploit this over the network with low complexity and no user interaction. By initiating a password change request, the attacker can reset the password on the hijacked account, including administrative ones, thereby achieving persistence within the compromised session and locking out legitimate users from accessing the account.
The issue has been addressed in OpenC3 COSMOS versions 6.10.5 and 7.0.0-rc3, as detailed in the project's security advisory (GHSA-wgx6-g857-jjf7) and corresponding release notes. Mitigation involves upgrading to these patched versions, with the fixing commit available at https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unverified password change flaw (requiring only a valid session) directly enables adversaries to modify account credentials for persistence on hijacked accounts (T1098 Account Manipulation) and to remove access for legitimate users by resetting passwords (T1531 Account Access Removal).