What is the CVSS score of CVE-2026-67975?

CVE-2026-67975 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of NASA cFS are affected by CVE-2026-67975?

NASA Core Flight System v7.0.1 contains an unauthenticated remote vulnerability in its telemetry subscription interface that allows attackers to manipulate telemetry routing and inject unauthorized…

How to fix or mitigate CVE-2026-67975?

Within 24 hours, conduct a comprehensive inventory of all systems running cFS v7.0.1, map network architecture and telemetry interface exposure, and assess business criticality of affected deployments. Within 7 days, implement strict network segmentation to restrict access to TO_LAB command interfaces (telemetry subscription paths), establish detailed monitoring and logging of all telemetry subscription changes, and document baseline telemetry stream configurations. Within 30 days, contact NASA regarding patch availability and upgrade timeline, develop contingency plans for systems where patching cannot be immediately deployed, and implement application-level validation mechanisms for telemetry commands if available as interim mitigations.

NASA cFS CVE-2026-67975

EUVD-2026-52511 HIGH

Improper Access Control (CWE-284)

2026-08-03 mitre

GHSA-xmm3-v54h-w2cc

Authentication Bypass N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Network-reachable unauthenticated command handler; I:H for subscription table manipulation; A:L added because removing subscriptions can disrupt telemetry data delivery.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 22:23 vuln.today

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.

AnalysisAI

Incorrect access control in NASA Core Flight System (cFS) v7.0.1 permits unauthenticated remote attackers to manipulate the telemetry subscription table by sending arbitrary TO_LAB (Telemetry Output Lab) add and remove subscription commands. Low-index subscriptions can be silently removed and new data streams injected, threatening the integrity of telemetry routing on ground-connected flight software deployments. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation activity, though the complete absence of authentication on a command interface is a structurally severe design flaw.

Technical ContextAI

NASA's Core Flight System (cFS) is an open-source, reusable spacecraft flight software framework built around the Core Flight Executive (cFE) message bus. The TO_LAB application is the Telemetry Output Lab component, designed primarily for ground testing rather than production flight use; it subscribes to software-bus message IDs and forwards telemetry packets over UDP to ground stations. The vulnerability (CWE-284, Improper Access Control) exists because TO_LAB exposes add-subscription and remove-subscription command handlers over the network without enforcing any authentication or authorization checks. Any network-reachable host can therefore send valid TO_LAB command packets to arbitrarily add or remove message-ID subscriptions, directly manipulating which telemetry streams are active. CPE data in NVD is recorded as 'n/a', making automated asset matching unreliable; affected version is confirmed by description as v7.0.1.

RemediationAI

No vendor-released patch with an exact fix version has been identified from available data at time of analysis. The GitHub issue https://github.com/nasa/cFS/issues/1076 should be monitored for upstream fix commits or tagged releases. Until a patch is released, the primary compensating control is network isolation: restrict access to the TO_LAB command port (typically UDP) to trusted ground station hosts using host-based or network firewall rules, which limits exploitation to those already on the trusted segment. Operators should also disable or remove the TO_LAB application entirely from any deployment that does not require live telemetry output in a lab environment, as the component is not required for flight builds. If TO_LAB must remain enabled, configure the cFE software bus to require command authentication where the platform supports it. Each control carries a trade-off: firewall rules depend on accurate network topology documentation, and disabling TO_LAB removes telemetry visibility for integration testing workflows. The NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-67975.