CVE-2025-25372
Published: 25 March 2025
Summary
CVE-2025-25372 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Nasa Core Flight System. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 25.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates incoming telecommands to prevent out-of-bounds writes from malicious inputs targeting the Memory Management Module.
Implements memory protection mechanisms like guard pages or stack canaries to block out-of-bounds writes that cause segmentation faults.
Requires timely remediation of the specific flaw in the cFS Aquila Memory Management Module via patching to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of the Memory Management Module via a crafted telecommand, triggering an out-of-bounds write that causes a segmentation fault and system crash, directly facilitating Endpoint Denial of Service through application exploitation.
NVD Description
NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.
Deeper analysisAI
CVE-2025-25372 is a vulnerability in NASA's Core Flight System (cFS) Aquila version that leads to a segmentation fault. It affects the Memory Management Module, which can be triggered by sending a malicious telecommand. The issue is categorized under CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting and sending a malicious telecommand to the Memory Management Module, the attacker can induce a segmentation fault, causing the affected cFS Aquila instance to crash and resulting in a denial-of-service condition.
Mitigation details and further assessment are available in the advisory published by VisionSpace at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/. The CVE was published on 2025-03-25.
Details
- CWE(s)