A missing authentication flaw in Efstratios Goudelis' Ground Station lets any unauthenticated network peer destroy or replace the entire SQLite database with a single Socket.IO event, rating CVSS 9.1 (CRITICAL).
What Is It
CVE-2026-53984 is an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the database_backup event handler of Ground Station's Socket.IO server. Authentication enforcement is disabled and the CORS policy is a wildcard, so an attacker can connect to the Socket.IO server on port 7000 with no credentials, emit the database_backup event with a full_restore command, and supply their own SQL blob. The handler drops every existing table and rebuilds the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed through raw exec_driver_sql, bypassing the ORM layer that would normally bound what a write can touch. The wildcard CORS policy widens the reachable attacker set further: a victim who merely browses a hostile page while on a network with line-of-sight to port 7000 can have that page open the socket on their behalf.
The weakness is classified as CWE-306 (Missing Authentication for Critical Function). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base score 9.1, CRITICAL. A secondary CVSS 4.0 score of 8.8 (HIGH) is also published.
Why It Matters
Exploitation requires no privileges, no user interaction, and low attack complexity over the network. Two outcomes are described in the advisory data:
- Destruction. All satellite records, orbital sources, hardware configurations, and observation schedules are permanently wiped.
- Manipulation. Rather than destroying data, an attacker can plant fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.
Confidentiality impact is rated NONE; the risk here is integrity and availability. The manipulation case is the more dangerous of the two. A wipe is loud: the station stops tracking, operators notice immediately, and recovery is a restore from backup. A targeted rewrite of orbital sources is silent; the software keeps running, the UI keeps showing satellites, and hardware keeps pointing according to data an attacker chose. Because injected rows are indistinguishable from legitimate ones once written, there is no obvious in-band signal that a restore ever happened, and an operator's own backups may be taken after the tampering and carry it forward.
Ground stations also tend to sit on lab, campus, or amateur-radio networks where the perimeter assumption is weaker than in a datacenter, and where a service listening on a fixed high port is unlikely to be behind an authenticating proxy. Operators should treat port 7000 exposure as the primary compensating control until patched.
What's Vulnerable
- Vendor: Efstratios Goudelis
- Product: Ground Station
- Affected versions: all versions prior to 0.6.0 (semver, default status: affected)
- Exposed service: Socket.IO server on port 7000
Patch Status
The issue is fixed in Ground Station 0.6.0; upgrade to 0.6.0 or later. The fix is published in commit 2ecde82 and documented in GitHub Security Advisory GHSA-mjp8-x6h7-229q. Where an immediate upgrade is not possible, restrict access to port 7000 to trusted hosts at the network or host firewall, since the vulnerability has no authentication step to harden and no configuration toggle is described that would disable the restore path on its own. Operators who suspect exposure should validate their orbital-source URLs and observation schedules against a known-good copy rather than assuming an intact-looking database is untampered.
No CISA KEV entry accompanies this record, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time. That absence is not evidence of safety; the exploit path is a single event emission with no precondition beyond reachability, well within reach of opportunistic internet-wide scanning. NVD status is "Received" as of 2026-08-06, meaning enrichment is still pending and the record may gain additional references or CPE data.
Sources
- NVD, CVE-2026-53984: https://nvd.nist.gov/vuln/detail/CVE-2026-53984
- GitHub Security Advisory GHSA-mjp8-x6h7-229q: https://github.com/sgoudelis/ground-station/security/advisories/GHSA-mjp8-x6h7-229q
- Fix commit (sgoudelis/ground-station): https://github.com/sgoudelis/ground-station/commit/2ecde82a8814cbea18883ce023bf45cbf06172eb
- Project repository: https://github.com/sgoudelis/ground-station