CyberRota Analysis
AI-GeneratedVersions of the ground-station software prior to 0.8.0 are vulnerable to an authentication bypass in the setup.restore command, enabling unauthenticated attackers to execute arbitrary SQL during the initial setup. This flaw allows attackers to create admin users and generate forged session tokens, facilitating unauthorized access and complete control over the application. Organizations using affected versions should prioritize patching this vulnerability to prevent potential exploitation and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.