CVE-2025-25373
Published: 25 March 2025
Summary
CVE-2025-25373 is a critical-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Nasa Core Flight System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations and permissions on system resources like the Memory Management Module, directly preventing unauthorized access leading to RCE.
Applies least privilege to restrict access to the Memory Management Module, mitigating insecure permissions that enable exploitation.
Provides architectural memory protections to block unauthorized code execution resulting from exploitation of insecure permissions in the Memory Management Module.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated RCE vulnerability in a network-accessible Memory Management Module, directly enabling exploitation of public-facing applications for arbitrary code execution and initial access.
NVD Description
The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.
Deeper analysisAI
CVE-2025-25373 is a critical vulnerability in the Memory Management Module of NASA's Core Flight System (cFS) Aquila, stemming from insecure permissions (CWE-732). Published on 2025-03-25, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote code execution (RCE) on the affected platform.
The vulnerability can be exploited by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation enables arbitrary code execution on the cFS Aquila platform, resulting in high-impact compromise of confidentiality, integrity, and availability.
Advisories and further details are available at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/.
Details
- CWE(s)