CVE-2026-53984
CriticalCVSS 9.1Summary
A vulnerability in Ground Station (before 0.6.0) allows unauthenticated attackers to destroy or replace the entire SQLite database by sending a full_restore command to the Socket.IO server on port 7000. Lack of authentication and wildcard CORS policy enable remote exploitation.
Risk Assessment
Attackers can permanently delete all satellite records, hardware configurations, and observation schedules, or inject fabricated data, potentially redirecting the ground station to attacker-controlled servers.
Recommendation
Upgrade Ground Station to version 0.6.0 or later. Enforce authentication for Socket.IO, restrict CORS, and disallow unauthorized database operations.
Original NVD description (English source)
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.