CVE-2026-79954

8.7 highEPSS 0.6%

High (8.7). EPSS 0.6% chance of exploitation in the next 30 days.

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-09-18
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://fluidattacks.com/advisories/linkin
https://github.com/nasa/CryptoLib

Check your stack JSON