CVE-2026-79954

EUVD-2026-82611
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
Fluid AttacksCNA
8.7 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.52%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nasacryptolib
1.5.0
CNA
Common Weakness Enumeration
References
https://fluidattacks.com/advisories/linkin
https://github.com/nasa/CryptoLib