CVE-2025-25374
Published: 25 March 2025
Summary
CVE-2025-25374 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Nasa Core Flight System. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 25.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-5 directly prevents denial-of-service events like this uncontrolled resource consumption vulnerability by implementing safeguards against platform-wide availability disruptions.
SC-6 protects resource availability from exhaustion attacks that block external application launches in cFS Aquila.
SI-2 ensures timely remediation of the specific flaw in cFS Aquila that allows remote attackers to induce a DoS state.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated DoS via resource consumption (CWE-400) that prevents external application launches and halts system operations, directly enabling T1499.004 Application or System Exploitation.
NVD Description
In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service.
Deeper analysisAI
CVE-2025-25374 is a denial-of-service vulnerability in NASA's Core Flight System (cFS) Aquila version, where it is possible to place the onboard software into a state that prevents the launch of any external applications. This issue, linked to CWE-400 (Uncontrolled Resource Consumption), carries a CVSS v3.1 base score of 7.5, reflecting high-impact availability disruption with no confidentiality or integrity effects.
The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without scope change (S:U). An unauthenticated attacker with network access to the affected cFS Aquila system can trigger the condition, resulting in a platform-wide denial of service by blocking all external application launches and halting normal onboard software operations.
Mitigation details and further assessment are available in the advisory published by Vision Space at https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/. Security practitioners should consult this reference for patching guidance or workarounds specific to cFS Aquila deployments.
Details
- CWE(s)