CVE-2026-53984 in Ground Station
Summary
by MITRE • 08/07/2026
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical security flaw in ground station software versions prior to 060 where an unauthenticated attacker can completely destroy or manipulate the system's database through a malicious Socket.IO event handler. The issue stems from the database_backup event handler in the Socket.IO server which lacks proper authentication enforcement and authorization checks, allowing any network peer to execute destructive operations without credentials. The vulnerability specifically manifests when attackers connect to the Socket.IO server on port 7000, where authentication has been disabled and a wildcard CORS policy permits cross-origin requests from any domain.
The technical exploitation involves sending a single full_restore command containing attacker-supplied SQL blob data that triggers raw exec_driver_sql execution. This mechanism allows for complete database destruction through DROP TABLE statements followed by recreation using CREATE TABLE and INSERT INTO commands provided by the attacker. The vulnerability is categorized as CWE-352 Cross-Site Request Forgery combined with CWE-94 Improper Control of Generation of Code, where the system fails to properly validate or sanitize input data before executing database operations.
The operational impact of this vulnerability is severe and far-reaching for satellite ground station operations. Attackers can permanently delete all satellite records, orbital sources, hardware configurations, and observation schedules that are stored in the SQLite database, effectively compromising the entire operational history and current planning capabilities. Additionally, the ability to inject fabricated data means attackers can manipulate orbital-source URLs and observation entries to redirect the ground station to attacker-controlled servers during scheduled sync operations, enabling potential command and control activities.
This vulnerability aligns with ATT&CK technique T1566 credential access through social engineering and T1071.004 application layer protocol network protocol deception where attackers can manipulate data flows between systems. The attack vector specifically relates to T1210 lateral movement through exploitation of remote services, as the Socket.IO server on port 7000 serves as an entry point for database manipulation. The lack of authentication enforcement and improper input validation creates a direct path for privilege escalation from unauthenticated access to full database control.
Mitigation strategies must address multiple layers of security including immediate implementation of authentication mechanisms for all Socket.IO endpoints, removal of wildcard CORS policies, and introduction of proper input validation and sanitization for all database operations. The system should enforce strict authorization checks before allowing any database modification operations, particularly those involving backup and restore functionality. Network segmentation and access control lists should be implemented to restrict direct access to port 7000, while also implementing rate limiting and monitoring for suspicious database activity patterns that could indicate exploitation attempts.