HIGH

CVE-2026-79954

2026-09-18 CVSS v4.0

CVSS

8.7

Description

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

Weakness (CWE)

CWE-306 Missing Authentication

EPSS Score

0.32%

Probability of exploitation in next 30 days

25.5th percentile

References

https://fluidattacks.com/advisories/linkin https://github.com/nasa/CryptoLib

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE