CVE-2026-79954

UNKNOWN 0.0

NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

CWE	CWE-306
Vendor	nasa
Product	cryptolib
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for nasa cryptolib

Be the first to know when new unknown vulnerabilities affecting nasa cryptolib are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

NASA / CryptoLib

1.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

fluidattacks.com: https://fluidattacks.com/advisories/linkin github.com: https://github.com/nasa/CryptoLib

Credits

Romel Marín