Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-53983— Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Quick assessment

Affected

Efstratios Goudelis Ground Station

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Efstratios Goudelis Ground Station是Efstratios Goudelis公司的一款卫星通信地面站设备。 Efstratios Goudelis Ground Station 0.6.0之前版本存在服务端请求伪造漏洞，该漏洞源于orbital-source配置路径对URL验证不当，可能导致未经身份验证的攻击者利用Socket.IO客户端发起服务端请求伪造攻击，向攻击者选择的目标发出HTTP请求。

CVSS 8.6 · High EPSS 0.57% · P47 Updated Aug 07, 2026

Possible ATT&CK Techniques 2 AI

T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Efstratios Goudelis	Ground Station	`< 0.6.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53983

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Source: CVE Program / CVE List V5

Vulnerability Description

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Vulnerability Title

Efstratios Goudelis Ground Station 服务端请求伪造漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Efstratios Goudelis	Ground Station	0 ~ 0.6.0	-

II. Public POCs for CVE-2026-53983

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

Qwen3.6-35B-A3B · 8971 chars

Pro+ exclusive includes:

Vulnerability reproduction recording (real sandbox build + trigger, exclusive)

In-depth vulnerability mechanism

Trigger conditions & impact

Full executable POC code

Exploit chain & mitigation

POC zip download

100+ AI POC generations per month

Upgrade to Pro+ to unlock Limited ¥499/month ¥599 Sign up first

III. Intelligence Information for CVE-2026-53983

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53983 (1)

🔗 Unauthenticated Socket.IO command execution (SSRF/DB restore/service restart) fixed by mandatory authentication and role-based authorization · Advisory · sgoudelis/ground-station · GitHub Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-53983

Same Patch Batch · Efstratios Goudelis · 2026-08-06 · 3 CVEs total

CVE-2026-53984	9.1 CRITICAL	Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection v
CVE-2026-53985	7.5 HIGH	Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

IV. Related Vulnerabilities

Same product: Ground Station

Same vendor: Efstratios Goudelis

Same weakness: CWE-918