CVE-2026-123485: falha de alta gravidade em sgoudelis ground-station
Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
sgoudelis · ground-stationCVEs relacionadas — sgoudelis ground-station
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 1.1%CVE-2026-103244CRITICALground-station before 0.8.0 Authentication Bypass via setup.restoreEPSS 0.6%CVE-2026-53452MEDIUMGround Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath`EPSS 0.5%