Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| NASA | fprime-gds | unknown |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 10 Aug 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the application enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control. | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. |
Mon, 10 Aug 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the application enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control. | |
| Title | NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published:
Updated: 2026-08-10T13:12:37.649Z
Reserved: 2026-08-10T10:32:53.854Z
Link: CVE-2026-72577
Vulnrichment
Updated: 2026-08-10T13:12:32.987Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-10T12:30:07Z