High severity · published Mar 25, 2025
CVE-2025-25371
NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Core Flight System · Nasa
6.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-25371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-25371
Exploit
https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
More from Core Flight System
9.8
CVE-2025-25373
The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform
8.8
CVE-2026-5474
NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow
7.5
CVE-2025-25374
In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial…
7.5
CVE-2025-25372
NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module
7.0
CVE-2026-5473
NASA cFS Pickle pickle.load deserialization