EUVD-2026-52478
GHSA-r93g-497c-7qvg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable CFDP listener requires no authentication; path control yields confidentiality loss only, with no integrity or availability impact confirmed.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.
AnalysisAI
Unauthenticated remote attackers can manipulate the CCSDS File Delivery Protocol (CFDP) metadata handler in NASA Core Flight System v7.0.1, specifically the CF_CFDP_RecvMd() function, to control the destination path where received file content is stored on the target system, resulting in high-impact information disclosure. A publicly available proof-of-concept exists per SSVC classification, making this exploitable without authentication or user interaction against any network-reachable cFS instance with the CF application enabled. Despite the availability of exploit code and network-accessible attack vector, the EPSS score of 0.14% (4th percentile) reflects the extremely limited real-world deployment footprint of this aerospace-domain platform.
Technical ContextAI
NASA's Core Flight System (cFS) is an open-source reusable flight software framework used in space missions. The CF application within cFS implements the CCSDS File Delivery Protocol (CFDP), a standard defined by the Consultative Committee for Space Data Systems for reliable file transfer over space communication links. The CF_CFDP_RecvMd() function is responsible for parsing incoming CFDP Metadata PDUs, which carry transfer-initiation parameters including the destination file path. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class, indicating insufficient validation or sanitization of the attacker-supplied destination path field within the metadata PDU. By crafting a malicious metadata PDU with an arbitrary or traversal-capable destination path, an attacker can redirect where the CF module writes received file content, potentially placing data in sensitive or unintended filesystem locations - a mechanism that enables the information disclosure impact confirmed by the C:H rating in the CVSS vector. The CPE data provided is non-specific ('n/a'), so precise version pinning beyond 'cFS v7.0.1' must be derived from the GitHub advisory at nasa/cFS issue #1073.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified at time of analysis - the primary reference is the GitHub issue at https://github.com/nasa/cFS/issues/1073, which should be monitored for upstream fix status. If a fix commit or tagged release becomes available on the nasa/cFS repository, operators should upgrade immediately. As a compensating control, operators should isolate the cFS CF application from untrusted networks by restricting CFDP UDP or TCP port access to known ground station IP ranges using firewall or access control lists - this eliminates the AV:N attack surface since CFDP traffic can be bounded to authorized endpoints. If the CF application is not operationally required, disabling it entirely removes the attack surface without side effects. Path validation and sanitization of the CFDP metadata destination field should be implemented as a code-level workaround in mission-specific forks pending upstream remediation. All compensating controls should be validated against mission operational requirements before deployment, as restricting CFDP communication channels may impact legitimate file transfer operations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today