Executive brief
Ground Station is a browser-based satellite tracking and SDR reception application. An unauthenticated attacker can connect to the Socket.IO server and force the application to terminate, disrupting all satellite tracking, radio reception, and hardware control operations. In containerized deployments, repeated attacks can create a persistent outage.
Technical details
The vulnerability is an unauthenticated denial-of-service in the Socket.IO server's service_control event handler. Authentication is disabled and a wildcard CORS policy allows any network peer to connect to port 7000 and emit a restart_service command, which forcibly terminates the ground-station process. This kills all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. In Docker deployments, the process will automatically restart, allowing an attacker to repeatedly trigger the crash and create a sustained denial-of-service condition. No authentication or special permissions are required.
Affected products
- sgoudelis Ground Station prior to 0.6.0
Timeline
- 2026-08-06: disclosed: CVE-2026-53985 published
- 2026-06-16: other: Commit 2ecde82 addressing concurrent database issues, suggesting ongoing development