What is the CVSS score of EUVD-2026-52506?

EUVD-2026-52506 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

OreSat Firmware EUVD-2026-52506

| CVE-2026-67673 MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-08-03 mitre

GHSA-whc8-rqfv-v7r9

Buffer Overflow Stack Overflow N A

4.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.6 MEDIUM

Physical UART3 hardware access is mandatory (AV:P); no credentials required at the interface (PR:N); impact is crash-only with no code execution or data exposure (A:H, C:N, I:N).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:27 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

4.6 (MEDIUM)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fw_flash command, where the <filename> argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical access to the UART3 serial interface can exploit this vulnerability by sending a maliciously crafted command with an oversized filename parameter,

AnalysisAI

Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted edl fw_flash command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.

Technical ContextAI

The flaw resides in the cmd_edl function of OreSat Firmware v1.0, the open-source firmware powering the OreSat CubeSat platform developed as a student satellite project. CWE-121 (Stack-Based Buffer Overflow) classifies the root cause: a fixed 64-byte stack buffer in cmd_edl is populated via memcpy() using the caller-supplied <filename> argument of the edl fw_flash subcommand, with no prior bounds check on the input length. This allows stack memory adjacent to the buffer to be overwritten. The affected CPE is listed as cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*, indicating NVD has not yet assigned a formal product identifier, reflecting the niche and non-commercial nature of this firmware. UART3 is a hardware debug/command serial interface exposed directly on the device board.

RemediationAI

The primary fix is a code-level patch adding input length validation in cmd_edl before the memcpy() call, ensuring the <filename> argument is truncated or rejected when it exceeds 63 bytes (preserving a null terminator). No specific patched firmware release version is confirmed in the available data - consult the upstream OreSat repository and the VulDB advisory at https://vuldb.com/vuln/385706 for patch availability and release status. As an immediate compensating control, restrict physical access to the UART3 serial interface by securing the device in a locked enclosure or physically removing UART3 header pins where the interface is not operationally required - this eliminates the attack vector entirely (AV:P) and is the most effective mitigation. If firmware update functionality via the edl fw_flash path is not needed, disabling or stripping the edl command handler from the firmware build removes the vulnerable code path with no operational trade-off.