CVE-2026-79954 — NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS process…
Published: 2026-09-18 · CVSS: 8.7 · CVSS 4.0
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7