CVE-2025-68271: OpenC3 COSMOS RCE Vulnerability

CVE-2025-68271 Overview

CVE-2025-68271 is a critical remote code execution (RCE) vulnerability affecting OpenC3 COSMOS, a platform designed to send commands to and receive data from embedded systems. The vulnerability exists in versions 5.0.0 through 6.10.1 and allows unauthenticated attackers to execute arbitrary Ruby code through the JSON-RPC API.

The flaw originates from unsafe use of Ruby's eval() function when processing array-like inputs through the String#convert_to_value method. Critically, the command code path parses attacker-controlled strings before authorization checks are performed, enabling exploitation even though the request ultimately fails with a 401 Unauthorized response.

Critical Impact

Unauthenticated remote code execution allowing complete system compromise. Attackers can execute arbitrary Ruby code on vulnerable OpenC3 COSMOS instances without any authentication, potentially gaining full control over embedded systems managed by the platform.

Affected Products

• OpenC3 COSMOS versions 5.0.0 through 6.10.1
• Systems utilizing the JSON-RPC API for command operations
• Embedded system management deployments running vulnerable OpenC3 COSMOS versions

Discovery Timeline

• 2026-01-13 - CVE-2025-68271 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68271

Vulnerability Analysis

This vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), commonly known as Code Injection. The flaw enables unauthenticated attackers to achieve remote code execution by exploiting unsafe dynamic code evaluation in the OpenC3 COSMOS JSON-RPC API.

The vulnerability is particularly severe because exploitation occurs before authorization checks are applied. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text flows into the String#convert_to_value method. For inputs that appear to be arrays, this method calls Ruby's eval() function to parse the string—directly executing any embedded Ruby code.

Root Cause

The root cause lies in the use of Ruby's eval() function to parse user-supplied input in the String#convert_to_value method. This dangerous pattern allows arbitrary code execution when processing array-like string inputs. The architectural flaw is compounded by the fact that the cmd code path parses and evaluates command strings before invoking the authorize() function, creating a pre-authentication attack surface.

Attack Vector

The attack is network-accessible and requires no authentication, user interaction, or special privileges. An attacker can craft a malicious JSON-RPC request containing Ruby code embedded within array-like string parameters. When the server processes this request, the convert_to_value method evaluates the malicious input using eval(), executing the attacker's code with the privileges of the OpenC3 COSMOS process.

The vulnerability is exploited through the JSON-RPC API endpoint by sending specially crafted requests where command parameters contain malicious Ruby code disguised as array syntax. The code executes during the parsing phase, before any authorization checks occur, meaning even failed requests trigger code execution.

For detailed technical analysis and proof-of-concept information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-68271

Indicators of Compromise

• Unusual JSON-RPC API requests containing array-like syntax with embedded Ruby code patterns such as system(), exec(), or backtick commands
• HTTP 401 responses preceded by unexpected system command execution or process spawning
• Log entries showing command parsing errors alongside suspicious process activity
• Network connections to command-and-control infrastructure originating from OpenC3 COSMOS processes

Detection Strategies

• Monitor JSON-RPC API traffic for requests containing Ruby metacharacters or eval-related syntax in parameter fields
• Implement web application firewall rules to detect array-like strings with embedded code patterns
• Deploy runtime application self-protection (RASP) to detect dynamic code evaluation attempts
• Enable detailed logging on OpenC3 COSMOS instances and correlate with system process monitoring

Monitoring Recommendations

• Audit all inbound requests to the JSON-RPC API endpoint for malicious payloads
• Configure intrusion detection systems to alert on Ruby code execution patterns in HTTP request bodies
• Monitor process creation events on systems running OpenC3 COSMOS for unexpected child processes
• Establish baseline behavior for the application and alert on deviations in system call patterns

How to Mitigate CVE-2025-68271

Immediate Actions Required

• Upgrade OpenC3 COSMOS to version 6.10.2 or later immediately
• If immediate patching is not possible, restrict network access to the JSON-RPC API endpoint to trusted sources only
• Implement network segmentation to limit exposure of OpenC3 COSMOS instances
• Review system logs for evidence of exploitation attempts and investigate any suspicious activity

Patch Information

OpenC3 has released version 6.10.2 which addresses this vulnerability. Organizations should prioritize upgrading all OpenC3 COSMOS installations from the affected version range (5.0.0 to 6.10.1) to the patched release. Refer to the GitHub Security Advisory for official remediation guidance.

Workarounds

• Restrict network access to the JSON-RPC API using firewall rules or network segmentation to allow only trusted IP addresses
• Deploy a web application firewall (WAF) with rules to block requests containing suspicious Ruby code patterns
• Consider temporarily disabling the JSON-RPC API if it is not operationally critical until patching can be completed
• Implement strict input validation at the network perimeter to filter potentially malicious payloads

# Example: Restrict JSON-RPC API access using iptables (Linux)
# Allow only trusted management network (example: 10.0.0.0/24)
iptables -A INPUT -p tcp --dport 2900 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2900 -j DROP