Security readout for executives and security teams
Plain-English summary
NASA fprime-gds through 3.4.3 reportedly exposes ground-station functions without authentication. A remote attacker reaching the Flask service could compromise its host and send unauthorized commands to connected spacecraft. This creates severe operational, safety, confidentiality, integrity, and availability risk.
Executive priority
Treat as an immediate incident-prevention priority wherever fprime-gds is deployed. Isolate reachable services, identify spacecraft-connected instances, and assign engineering and mission-operations owners. Consider incident response if an affected service was exposed, because the potential impact includes host takeover and unauthorized spacecraft control.
Technical view
The supplied CVE describes missing authentication across Flask endpoints, combined with path traversal, enabling unauthenticated remote code execution and spacecraft command injection. CVSS 3.1 is 9.8: network-accessible, low complexity, no privileges or user interaction, with high impact. The source bundle identifies CWE-306 but provides incomplete structured version data.
Likely exposure
Highest exposure exists where the fprime-gds Flask service is reachable from untrusted or insufficiently segmented networks. Systems connected to spacecraft or running with valuable host privileges have especially serious consequences. The bundle says versions through 3.4.3 are affected, although its structured affected-version entry is inconsistent and marked unknown.
Exploitation context
The bundle does not establish active exploitation, and KEV is false. Exploitation is nevertheless described as remotely reachable, unauthenticated, low complexity, and requiring no user interaction. No exploit instructions or confirmed attack campaigns are provided.
Researcher notes
The description claims impact through 3.4.3, but the structured affected record lists version "0" with unknown default status. Confirm scope with current NASA or CVE guidance before declaring individual versions safe. The bundle references updown.py and commands.py, but does not name a patch, fixed commit, public proof of concept, or observed exploitation.
Mitigation direction
- Immediately restrict fprime-gds access to trusted management networks and authorized operators.
- Disconnect unnecessary spacecraft command links until exposure is assessed.
- Check NASA repository, PyPI, and CVE guidance for an official fixed release or mitigation.
- Upgrade only according to verified vendor guidance; the supplied sources name no fixed version.
- Rotate credentials and secrets accessible from any potentially compromised ground-station host.
Validation and detection
- Inventory fprime-gds installations and record exact package versions.
- Confirm whether each Flask service is reachable from untrusted networks.
- Verify authentication is enforced before all ground-station operations.
- Review host and application logs for unexpected uploads, file access, commands, or process execution.
- Inspect connected spacecraft command histories for unauthorized or anomalous activity.
- After remediation, retest network restrictions and authentication without sending operational spacecraft commands.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72577 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9TuranSecVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineTuranSec
CVE Reserved
- Source timelineTuranSec
Public Disclosure
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ProductCVE reference, TuranSec · third-party-advisory
- PyPI PackageCVE reference, TuranSec · third-party-advisory
- Vulnerable File (updown)CVE reference, TuranSec · technical-description
- Vulnerable File (commands)CVE reference, TuranSec · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.