CyberRota Analysis
AI-GeneratedThe vulnerabilities in NASA's fprime-gds version 3.4.3 expose the ground station host to unauthenticated remote code execution and command injection, enabling attackers to manipulate connected spacecraft. The lack of authentication in the Flask application, combined with a path traversal flaw and a hardcoded secret key, allows for arbitrary file access and session forgery. Organizations utilizing this system, particularly those involved in space operations, should prioritize immediate remediation to prevent potential exploitation and compromise of critical assets.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.