EUVD-2026-82611
GHSA-64r5-qp28-crvm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable frame injection with no authentication (PR:N) exploiting a missing authorization check; impact is forged/downgraded commands so integrity-only (I:H), with no confidentiality or availability effect.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
2DescriptionCVE.org
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
AnalysisAI
An authentication downgrade in NASA CryptoLib 1.5.0 lets a remote, unauthenticated attacker defeat Space Data Link Security (SDLS) authentication on the Telecommand receive path by crafting a frame whose Security Parameter Index (SPI) names a weaker Security Association (SA) than the one legitimately authorized for that frame's Global Virtual Channel ID (GVCID). Because the receiver never checks that the selected SA is permitted for the frame's GVCID, the command is processed under the attacker-chosen SA, giving high integrity impact (VI:H, C:N, A:N) against spacecraft or ground-segment command handling. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a target running NASA CryptoLib 1.5.0 for TC SDLS processing with more than one Security Association configured such that at least one SA provides weaker or mismatched authentication for a given GVCID, plus the ability to inject frames into the Telecommand receive path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-impact integrity flaw with a moderate real-world exploitation ceiling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the primary action is to track https://github.com/nasa/CryptoLib and the Fluid Attacks advisory https://fluidattacks.com/advisories/linkin for a fixed release or commit that enforces the SA-to-GVCID authorization check, and to deploy that update as soon as it is published; do not assume a version number until the vendor confirms one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of NASA CryptoLib 1.5.0 across spacecraft and ground segment command paths, and immediately restrict access to TC uplink/command channels to only trusted ground stations and networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
CryptoLib versions prior to 1.4.3 contain an out-of-bounds read vulnerability in the Crypto_AOS_ProcessSecurity function
CryptoLib versions prior to 1.4.3 contain a heap buffer overflow in the KMC crypto service's Base64 decoder, where overs
CryptoLib versions prior to 1.4.3 are vulnerable to denial of service through unbounded memory allocation in the KMC cry
CryptoLib versions prior to 1.4.3 contain an out-of-bounds heap read in the cryptography_aead_encrypt() function, affect
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c). Rated high s
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDL
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today