Description

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T16:16:43.620Z",
  "pubdate": "2026-08-06T16:16:43.620Z",
  "executiveSummary": "Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability residing in the Socket.IO server's service_control event handler.\nThe vulnerability allows any unauthenticated network peer to forcibly terminate the ground-station process by issuing a single restart_service command.\nAffected systems include deployments of Ground Station prior to version 0.6.0 running a Socket.IO server on port 7000.\nRisk implications are severe, as attackers can disrupt critical aerospace operations by terminating all active satellite-tracking sessions, software-defined radio (SDR) recording pipelines, demodulators, decoders, and rotator controllers.\nAttacker capabilities require only network connectivity to the vulnerable Socket.IO server.\nExploitation requirements are minimal due to disabled authentication enforcement and a permissive wildcard CORS policy on the target service.\nIn Docker deployments, attackers can repeatedly trigger the command to maintain a persistent denial-of-service condition against the ground station infrastructure.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of the Socket.IO server within Ground Station prior to version 0.6.0.\nThe vulnerable component is the service_control event handler exposed via the Socket.IO interface operating on port 7000.\nAuthentication enforcement is completely disabled for the affected endpoint, and a wildcard Cross-Origin Resource Sharing (CORS) policy is configured, allowing arbitrary network peers to establish connections without credentials.\nThe attack flow proceeds as follows: First, an unauthenticated attacker connects over the network to the Socket.IO server running on port 7000. Second, the attacker emits the service_control event with a restart_service command payload. Third, the unvalidated command is processed by the service_control event handler. Fourth, the ground-station process executes the termination command, causing an immediate crash or restart of the application.\nPayload behavior involves transmitting the specific restart_service command through the Socket.IO protocol abstraction.\nPost-exploitation impact includes the immediate cessation of all operational tasks managed by the ground station, such as satellite-tracking sessions, SDR recording pipelines, signal demodulators, decoders, and hardware rotator controllers.\nIn containerized environments such as Docker deployments, where process managers or orchestration policies automatically restart crashed containers, attackers can repeatedly emit the payload to create a persistent denial-of-service condition."
}