CVE-2026-53985: Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's servicecontrol event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restartservice command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the servicecontrol event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ground Stationto a version that resolves this vulnerability.Fixed in 0.6.0 - Configuration
Ensure authentication enforcement is enabled for the Socket.IO server so unauthenticated peers cannot invoke the service_control event handler (e.g., prevent unauthenticated restart_service/service_control commands).
Socket.IO server (Ground Station) authentication enforcement for Socket.IO connections = enabled - Configuration
Restrict Socket.IO CORS policy to specific allowed origins instead of a wildcard policy so browsers/clients cannot use a permissive '*' CORS configuration to reach the service_control endpoint.
Socket.IO server (Ground Station) CORS policy = no wildcard (do not allow '*' )
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53985?
The severity of CVE-2026-53985 is rated high with a score of 7.5.
How does CVE-2026-53985 affect Ground Station?
CVE-2026-53985 allows unauthenticated users to launch a denial-of-service attack by terminating the ground-station process.
How do I fix CVE-2026-53985?
To fix CVE-2026-53985, upgrade to Ground Station version 0.6.0 or later.
Can CVE-2026-53985 be exploited remotely?
Yes, CVE-2026-53985 can be exploited remotely by any unauthenticated network peer.
What is the primary impact of CVE-2026-53985?
The primary impact of CVE-2026-53985 is an unauthenticated denial-of-service condition affecting the Ground Station application.