NASA CryptoLib EUVD-2026-82611

Exploitation requires a target running NASA CryptoLib 1.5.0 for TC SDLS processing with more than one Security Association configured such that at least one SA provides weaker or mismatched authentication for a given GVCID, plus the ability to inject frames into the Telecommand receive path. The attacker crafts a frame whose SPI references the weaker SA; the missing GVCID-authorization check causes it to be selected. Limiting factors: the attacker must reach the TC uplink/command channel (typically an RF ground station link or the internal command network rather than the open internet), and an exploitable weaker SA must exist in the configuration - the flaw is an authorization/downgrade issue rather than confidentiality exposure (VC:N).

This is a genuine high-impact integrity flaw with a moderate real-world exploitation ceiling. The vendor CVSS 4.0 base score is 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N), i.e. network-reachable, unauthenticated, low-complexity, with high impact confined to integrity - no confidentiality or availability loss. That vector is internally consistent with CWE-306 (missing authentication for a critical function): by selecting the Security Association purely from the attacker-controlled SPI field without checking it is authorized for the frame's GVCID, an attacker can force use of a weaker/mismatched SA and get forged or authentication-downgraded telecommands accepted. No EPSS score, no CISA KEV listing, and no public proof-of-concept were supplied, so exploitation is theoretical at time of analysis rather than observed - no public exploit identified at time of analysis. The signals partly conflict with CVSS's AV:N/PR:N optimism: reaching a spacecraft/ground TC receive path in practice usually requires access to an RF uplink or the command network, which CVSS does not model as attack complexity but is a real limiting factor. Net: for any organization actually running CryptoLib in a command path this is a priority integrity issue (forged commands to a spacecraft/ground system are severe), but the tiny deployment footprint and access barrier keep aggregate/mass-exploitation risk low.

An attacker with access to the Telecommand uplink or command network crafts a TC frame whose SPI points to a Security Association offering weaker or no authentication while carrying a GVCID that should require a stronger SA. Because CryptoLib selects the SA from the SPI alone and never verifies it is authorized for that GVCID, the receiver processes the forged/downgraded frame and accepts the illegitimate telecommand. No public exploit code was identified at time of analysis; the flaw was reported by Fluid Attacks.