EUVD-2026-54275
GHSA-g756-f8g3-qffc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication (PR:N), no complexity barrier; integrity and availability both fully compromised; no confidentiality impact or scope change described.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.
AnalysisAI
Unauthenticated database destruction and arbitrary SQL injection in Ground Station's Socket.IO server allows any network peer to permanently wipe or replace the entire SQLite database without credentials. The database_backup event handler on port 7000 accepts a caller-supplied SQL blob and executes it via raw exec_driver_sql, enabling complete erasure of satellite records, orbital sources, hardware configurations, and observation schedules, or implantation of malicious orbital-source URLs that redirect the ground station to attacker-controlled infrastructure on the next scheduled sync. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the attack requires no authentication and no special configuration, making exploitation trivial from any host with network reach to port 7000.
Technical ContextAI
Ground Station is a satellite ground station management application (GitHub: sgoudelis/ground-station) that exposes a Socket.IO server on TCP port 7000 for real-time backend communication. The vulnerable endpoint is the database_backup event handler, which processes a full_restore command by accepting a caller-supplied SQL blob and passing it directly to SQLAlchemy's exec_driver_sql - a low-level method that bypasses ORM-level validation and executes arbitrary raw SQL. The root cause is CWE-306 (Missing Authentication for Critical Function): authentication enforcement is explicitly disabled on the Socket.IO server, and a wildcard CORS policy is configured, meaning any origin and any unauthenticated client can connect and emit the destructive event. The underlying database is SQLite. The affected CPE corresponds to the sgoudelis/ground-station project versions prior to 0.6.0.
RemediationAI
Upgrade to Ground Station 0.6.0 or later, which contains the fix introduced in commit 2ecde82a8814cbea19883ce023bf45cbf06172eb (https://github.com/sgoudelis/ground-station/commit/2ecde82a8814cbea18883ce023bf45cbf06172eb). If immediate upgrade is not possible, restrict network access to TCP port 7000 at the firewall or host level so that only trusted management hosts can reach the Socket.IO server - this is the most effective compensating control given the unauthenticated nature of the vulnerability, though it does not address the missing authentication defect itself. Additionally, consider disabling the Socket.IO server entirely if the database backup/restore feature is not operationally required, accepting the trade-off of losing remote backup functionality. Do not rely on CORS policy changes alone as a mitigation, since CORS is a browser-enforced mechanism that does not prevent direct socket connections from scripted clients or command-line tools. Consult the GitHub Security Advisory at https://github.com/sgoudelis/ground-station/security/advisories/GHSA-mjp8-x6h7-229q for authoritative guidance.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today