CVE-2026-53984

Received Received - Intake

Unauthenticated Database Destruction in Ground Station

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-53984

Affected Vendors & Products

Vendor	Product	Version / Range
ground_station	ground_station	to 0.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Ground Station software versions prior to 0.6.0. It allows unauthenticated attackers to destroy the entire SQLite database or inject arbitrary data by exploiting the Socket.IO server's database_backup event handler. Attackers can connect without credentials due to disabled authentication and a wildcard CORS policy, then send a malicious full_restore command to wipe or replace the database with attacker-controlled SQL commands.

Detection Guidance

Check if the Ground Station Socket.IO server is running on port 7000 without authentication. Use netstat or ss to verify open ports: netstat -tulnp | grep 7000 or ss -tulnp | grep 7000. Test unauthenticated access by connecting via telnet or nc: nc localhost 7000 or telnet localhost 7000. If connected without credentials, the service is vulnerable.

Impact Analysis

If exploited, this vulnerability can permanently destroy all satellite records, orbital sources, hardware configurations, and observation schedules. Attackers could also plant fake orbital-source URLs and observation entries that redirect the ground station to malicious servers during the next sync, leading to data loss or compromised operations.

Mitigation Strategies

Upgrade Ground Station to version 0.6.0 or later to enforce authentication and fix the database_backup vulnerability. If upgrading is not immediately possible, restrict network access to port 7000 using a firewall to block unauthorized connections. Disable or remove the vulnerable Socket.IO server if unused.

Hi! I’m here to help you understand CVE-2026-53984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70