CVE•Published 2025-03-25•Modified 2026-04-30•1 article on news•5 live references•NVD data

CVE-2025-25373Nasa · Core_flight_system

Vulnerability data via NVD (ingested)

CVSS v3.1

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 36% of all CVEs

Weaknesses (CWE)

CWE-732Incorrect Permission Assignment for Critical Resource

Description

The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.

Timeline

Published 2025-03-25

Modified 2026-04-30

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-25373

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product + version

product:"Nasa Core Flight System" version:"6.7.0"

Version-pinned fingerprint from NVD's first vulnerable CPE.

Shodan · banner/body mention

http.html:"Core Flight System"

HTTP body or banner mentions "Core Flight System" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-25373

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2025-25373

Censys host search filtered to this CVE id.

grep.app

CVE-2025-25373

Public source-code mentions — fast PoC discovery.

GitHub code

CVE-2025-25373

GitHub code search for direct mentions.

Google dork

"CVE-2025-25373" exploit -site:nvd.nist.gov

Write-ups and news, NVD excluded.

Known PoCs on GitHub (4)

CVE-2025-253734 repos

Amperclock/CVE-2025-9491_POCPython

Proof-of-Concept of the CVE-2025-9491 using invisible characters in the arguments of a Windows shortcut file (.lnk)

★ 18·updated 8mo ago

nafiez/DataBlockNTLMLeakRuby

Windows Shell Link (LNK) Proof of Concept

★ 16·updated 11mo ago

opendr-io/causalityJupyter Notebook

The difference between exploitation prediction and detection is akin to the difference between detecting a missile launch or a detonation. Every avoided exploitation cycle saves hu…

★ 13·updated today

EuanKerr/LNKsmithPython

★ 2·updated 5d ago