CVE-2026-42084
Openc3 Cosmos ≤ 6.10.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-42084 is a high-severity Unverified Password Change (CWE-620) vulnerability in Openc3 Cosmos. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-11 (Re-authentication) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42084 affects OpenC3 COSMOS, an open-source platform for sending commands to and receiving data from embedded systems. The vulnerability resides in the password change functionality in versions prior to 6.10.5 and 7.0.0-rc3, where users can update their password without providing the current one, relying solely on a valid session token for authentication. This flaw, classified under CWE-620 (Unverified Password Change), carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts.
An attacker with low privileges (PR:L) who has already obtained a valid session token—such as through prior account compromise—can exploit this over the network with low complexity and no user interaction. By initiating a password change request, the attacker can reset the password on the hijacked account, including administrative ones, thereby achieving persistence within the compromised session and locking out legitimate users from accessing the account.
The issue has been addressed in OpenC3 COSMOS versions 6.10.5 and 7.0.0-rc3, as detailed in the project's security advisory (GHSA-wgx6-g857-jjf7) and corresponding release notes. Mitigation involves upgrading to these patched versions, with the fixing commit available at https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-27057
Vulnerability Data
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the…
more
old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Re-authentication explicitly requires users to prove identity before performing sensitive actions such as password changes.
Authenticator management requires identity verification during password distribution and changes, directly stopping unverified password updates.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.
Mandates secure authentication mechanisms, which include verifying existing credentials before permitting password changes.