CubeSpace CW0057 CVE-2026-13743

Physical access to the CW0057 hardware is the sole prerequisite - no authentication, no network access, and no elevated privileges are required once physical contact with the firmware update interface is established. Exploitation is limited exclusively to scenarios where an attacker can physically connect to the device's firmware update interface (e.g., during ground handling, integration, storage, or maintenance). On-orbit exploitation is not feasible unless the device also exposes a remotely accessible firmware update channel, which is not indicated by available data. All firmware versions prior to 5.0.20 are vulnerable regardless of configuration. The CVSS 4.0 vector (PR:N) confirms no privileges are required at the device level given physical access.

The CVSS 4.0 base score of 3.3 accurately reflects the dominant constraint: physical access (AV:P) is required, which sharply limits the attacker population in most operational scenarios. However, the integrity and availability impacts are both rated High (VI:H/VA:H), meaning a successful attack can fully compromise device firmware with no confidentiality exposure. The E:P supplemental metric confirms a proof-of-concept exists, elevating practical risk above a theoretical-only finding. No KEV listing means active, widespread exploitation has not been confirmed by CISA. For space-sector operators, the risk calculus is asymmetric: physical access to CubeSat hardware is routinely available during ground integration, testing, and pre-launch processing windows - phases where supply chain or insider threat actors may have unrestricted physical contact. The 'Information Disclosure' tag is not clearly reflected in the CVSS impact metrics (VC:N) and may reference a secondary or related finding not fully described in the primary advisory; this discrepancy should be clarified with the vendor advisory ICSA-26-183-02. EPSS data was not provided in the source intelligence; given physical access requirements, real-world exploitation probability at scale is low but mission-critical risk per-device is high.

During satellite integration at a launch facility or test environment, an insider or supply chain actor with physical access connects to the CW0057 firmware update port (e.g., via USB or UART interface), submits a crafted or unsigned firmware image that exploits the absent/weak JWT signature check, and successfully flashes malicious firmware - potentially introducing logic that causes attitude control failures or enables persistent backdoor behavior on-orbit. A proof-of-concept for this bypass exists, lowering the technical barrier for exploitation.