Cyber Posture

CVE-2025-25373

CriticalPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
30 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 55.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25373 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Nasa Core Flight System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces approved authorizations and permissions on system resources like the Memory Management Module, directly preventing unauthorized access leading to RCE.

prevent

Applies least privilege to restrict access to the Memory Management Module, mitigating insecure permissions that enable exploitation.

prevent

Provides architectural memory protections to block unauthorized code execution resulting from exploitation of insecure permissions in the Memory Management Module.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE describes a remote unauthenticated RCE vulnerability in a network-accessible Memory Management Module, directly enabling exploitation of public-facing applications for arbitrary code execution and initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.

Deeper analysisAI

CVE-2025-25373 is a critical vulnerability in the Memory Management Module of NASA's Core Flight System (cFS) Aquila, stemming from insecure permissions (CWE-732). Published on 2025-03-25, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote code execution (RCE) on the affected platform.

The vulnerability can be exploited by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation enables arbitrary code execution on the cFS Aquila platform, resulting in high-impact compromise of confidentiality, integrity, and availability.

Advisories and further details are available at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/.

Details

CWE(s)

Affected Products

nasa
core flight system
6.7.0

CVEs Like This One

CVE-2025-25372Same product: Nasa Core Flight System
CVE-2025-25371Same product: Nasa Core Flight System
CVE-2025-25374Same product: Nasa Core Flight System
CVE-2026-5474Same product: Nasa Core Flight System
CVE-2026-21897Same vendor: Nasa
CVE-2025-30216Same vendor: Nasa
CVE-2026-22697Same vendor: Nasa
CVE-2025-29912Same vendor: Nasa
CVE-2025-29909Same vendor: Nasa
CVE-2024-55030Same vendor: Nasa

References