CVE-2026-79954

Vulnerability Description

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

Related Weaknesses (CWE)

CWE-306

References

https://fluidattacks.com/advisories/linkin
https://github.com/nasa/CryptoLib

FAQ

What is CVE-2026-79954?

CVE-2026-79954 is a documented vulnerability. NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI...

How severe is CVE-2026-79954?

CVSS scoring is not yet available for CVE-2026-79954. Check NVD for updates.

Is there a patch for CVE-2026-79954?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.