AcubeSAT OBC CVE-2026-75370

Exploitation requires the ability to inject crafted CAN messages onto the CAN bus segment physically connected to the AcubeSAT OBC - a local serial field bus that is not natively routable over IP networks. This typically requires physical access to the bus wiring or compromise of a trusted node already on the same CAN segment. No CAN protocol-level authentication exists, so no credentials are required once bus access is obtained. The NVD-assigned CVSS UI:R (user interaction required) has not been explained by available documentation and is inconsistent with autonomous message-parsing behavior; operators should not rely on this as a limiting factor without vendor confirmation. Exploitation is bounded to systems running AcubeSAT OBC software at or near commit eaf90ec. The highly specialized spacecraft and ground-test-bench deployment context substantially restricts the realistic attacker population compared to general-purpose networked software.

Real-world risk is substantially constrained by the extreme specialization of the affected platform: AcubeSAT OBC software is used in a niche academic and research CubeSat mission context, not in broadly deployed enterprise or consumer infrastructure. The NVD-assigned CVSS 3.1 score of 6.5 Medium uses AV:N/AC:L/PR:N/UI:R - however, the network attack vector is inconsistent with CAN bus, which is a local serial field bus requiring physical or adjacent-network proximity, not an IP-routed network path; this discrepancy suggests the assigned CVSS vector may overstate remote exploitability and should be verified with the vendor. The UI:R (user interaction required) designation is also atypical for a message-parsing vulnerability triggered autonomously by inbound CAN frames and similarly warrants vendor clarification. EPSS at 0.15% (4th percentile) reflects extremely low exploitation probability, aligned with the platform's niche footprint and the technical barrier of requiring CAN bus access. No CISA KEV entry exists, and no confirmed weaponized exploit has been identified at time of analysis. The GitHub issue reference may represent a proof-of-concept disclosure, but this has not been verified. Practical exploitation requires physical or adjacent CAN bus access - a prerequisite that substantially limits the realistic threat surface beyond what the raw CVSS score implies.

An attacker with access to the CAN bus segment - obtained via physical connection to the bus wiring or by compromising another CAN-connected node - sends a crafted CAN message containing an ECSS telecommand header with malformed length or offset values. The AcubeSAT OBC's MessageParser::parseECSSTCHeader processes the packet without adequate bounds enforcement, triggering an out-of-bounds read or write that corrupts adjacent memory or crashes the OBC process, rendering the spacecraft's onboard computer unavailable. The GitHub issue at dazuo233/cve/issues/5 documents this finding and may contain proof-of-concept message crafting details.