EUVD-2026-62497Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable Socket.IO commands (AV:N/PR:N/UI:N) chain deterministically to code execution and crash loop, yielding AC:L with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal and writes attacker-controlled base64-decoded bytes outside backend/data/snapshots. An attacker can write a logging YAML file containing a logging.config.dictConfig callable factory, use the unauthenticated update-app-config operation to set log_config to that file, and invoke restart_service. During restart, backend/common/logger.py passes the YAML through resolve_log_config_path(), yaml.safe_load(), and logging.config.dictConfig(), which executes the factory with service privileges and can also cause a persistent crash loop. This issue is fixed in version 0.4.13.
AnalysisAI
Unauthenticated remote code execution in sgoudelis Ground Station before 0.4.13 arises from chaining a path-traversal file write with an insecure logging-config reload. The unauthenticated save-waterfall-snapshot Socket.IO command lets a remote attacker write attacker-controlled bytes anywhere on disk, then use the equally unauthenticated update-app-config and restart_service commands to load a malicious logging YAML that executes a Python callable factory with service privileges (or forces a persistent crash loop). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to Ground Station's unauthenticated Socket.IO command interface on a version prior to 0.4.13. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to a genuine high priority for anyone actually running this software: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) reflects a fully remote, unauthenticated, low-complexity attack with High confidentiality, integrity, and availability impact, and the described chain (arbitrary file write plus config-driven code execution) supports that C:H/I:H/A:H rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Ground Station Socket.IO endpoint (e.g., an internet-exposed or LAN-reachable instance) sends save-waterfall-snapshot with a snapshotName containing traversal or an absolute path plus a base64 payload, planting a malicious logging YAML on disk. They then call update-app-config to point log_config at that file and invoke restart_service, causing logging.config.dictConfig to execute their callable factory as the service user. … |
| Remediation | Upgrade to Ground Station 0.4.13, which adds backend/common/pathguard.py and confines snapshot/recording writes to allowlisted roots (Vendor-released patch: 0.4.13; see https://github.com/sgoudelis/ground-station/releases/tag/v0.4.13 and advisory GHSA-q35x-w3h6-36w8). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all sgoudelis Ground Station deployments and document installed versions; isolate any instances running versions before 0.4.13 from untrusted networks and restrict inbound access to known, trusted clients only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ground Station
View allUnauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly termina
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today