CyberRota Analysis
AI-GeneratedNASA CryptoLib 1.5.0 is vulnerable to an authentication downgrade attack in its Telecommand receive path, where the Security Association (SA) selection is based solely on the SPI field without verifying its authorization for the specific GVCID. This flaw could allow an attacker to exploit the system by manipulating the incoming frames, potentially leading to unauthorized access or control. Organizations using this library, particularly in aerospace or critical infrastructure sectors, should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.