Read the docs
TI-2026-38942 Aliases CVE-2026-53985GHSA-9h78-49rc-9p23

Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

Priority MEDIUM 45CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00707 53rd percentileScored 2026-11-07
Fix Fixed Ground Station (Efstratios Goudelis): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Efstratios GoudelisGround Stationbefore 0.6.00.6.0Patch availableCNA
  • Ground Station VendorEfstratios Goudelis Affected before 0.6.0 Fixed in 0.6.0 Patch available CNA

Remediation

  • Fix · CNA Ground Station (Efstratios Goudelis) Fixed in 0.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Efstratios Goudelis Ground Station — GitHub Security Advisory (GHSA-mjp8-x6h7-229q)

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-38940 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URLPriority MEDIUM 46
    • TI-2026-38941 Missing authentication in Efstratios Goudelis Ground StationPriority MEDIUM 45
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53985
  2. 2026-10-03 Alias added: GHSA-9h78-49rc-9p23

References

Patch 1

Advisory 1

Other 1

  • TI-2026-38940 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL CVSS 4.0CRITICAL 9.2
  • TI-2026-38941 Missing authentication in Efstratios Goudelis Ground Station CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences