CVE-2026-42084

{
  "id": "CVE-2026-42084",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T18:16:30.357",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3."
    },
    {
      "lang": "es",
      "value": "OpenC3 COSMOS proporciona la funcionalidad necesaria para enviar comandos a y recibir datos de uno o más sistemas embebidos. Antes de las versiones 6.10.5 y 7.0.0-rc3, la funcionalidad de cambio de contraseña de OpenC3 permite a un usuario cambiar su contraseña sin proporcionar la contraseña antigua, al aceptar un token de sesión válido en su lugar. En escenarios de brecha asumida, este comportamiento puede ser explotado por un atacante que ya ha obtenido un token de sesión válido, para obtener persistencia en una cuenta secuestrada (incluyendo la de administrador) y evitar que usuarios legítimos accedan a la cuenta. Este problema ha sido parcheado en las versiones 6.10.5 y 7.0.0-rc3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "OpenC3",
          "product": "cosmos",
          "versions": [
            {
              "version": "< 6.10.5",
              "status": "affected"
            },
            {
              "version": ">= 7.0.0.pre.rc1, < 7.0.0-rc3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T13:39:31.426814Z",
          "id": "CVE-2026-42084",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-620"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*",
              "versionEndExcluding": "6.10.5",
              "matchCriteriaId": "930EEABE-50A2-4005-AE3C-2D14AF5A60BD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*",
              "matchCriteriaId": "38B72355-49A3-4D2F-BFDB-EE53C9E2C7AD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*",
              "matchCriteriaId": "13E3A0EA-1085-4505-80BB-C0B133EC3498"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}