OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, …

OpenC3 COSMOS contains a vulnerability in its password change functionality that allows users to change passwords without providing the old password, accepting only a valid session token. This flaw can be exploited by attackers who have obtained a valid session token to maintain persistence in hijacked accounts, including admin accounts, and prevent legitimate users from accessing their accounts. The vulnerability affects versions prior to 6.10.5 and 7.0.0-rc3, and has been patched in these versions.