External risk intelligence

Ground Station YAML Injection and Service Hijacking Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-53451

The application is a browser-based suite that functions as a web-accessible server for satellite tracking and hardware control. Given its nature as a web-based dashboard and control interface, it is commonly deployed as an accessible network service to enable remote monitoring and management, making public or internal internet-facing exposure a likely deployment pattern.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Ground Station, a browser-based suite for satellite tracking and hardware control, allowing unauthenticated attackers to execute code with service privileges and potentially cause persistent crashes. The issue stems from how the system handles snapshot names, enabling directory traversal and the injection of malicious logging configurations.

Attackers can run code remotely.
It impacts satellite tracking and control systems.
Confirm relevance and exposure of this critical vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a vulnerability in the Ground Station's snapshot saving feature to write arbitrary files on the server. This allows them to create a malicious YAML configuration for logging, which can then be loaded by the application. When the service restarts, this configuration is processed, executing attacker-controlled code with service privileges. This can lead to a complete system compromise or a persistent denial of service.

No authentication required.
Writes a malicious YAML file via snapshot feature.
Arbitrary code execution and denial of service.

Live Threat

Current exploitation, exposure, and threat context

The Ground Station application's unauthenticated save-waterfall-snapshot command could allow an attacker to write arbitrary files, including a malicious YAML configuration. This could enable the attacker to execute code with service privileges and potentially cause a persistent crash loop.

System configuration files.
Arbitrary file writes.
Code execution and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ground Station application, used for satellite tracking and hardware control, has a critical vulnerability. Application owners and infrastructure teams should prioritize identifying all instances of this software. The first practical step is to confirm if the affected instances are internet-facing or accessible from untrusted networks and to determine their business criticality to inform remediation priority.

Confirm asset ownership and exposure.
Verify if instances are internet-facing.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ground Station and how is it used?

Ground Station is a browser-based software suite designed for satellite tracking, SDR (Software Defined Radio) signal reception, hardware control, and telemetry decoding. It provides a dashboard interface that allows users to remotely monitor satellite data and manage radio hardware operations from a centralized web server.

What does CWE-22 and CWE-94 mean for CVE-2026-53451?

This vulnerability involves path traversal (CWE-22) and improper control of generation of code (CWE-94). An attacker uses the path traversal flaw to write an unauthorized file to the server. They then exploit the code injection weakness by tricking the application into reading that file as a logging configuration, which forces the system to execute malicious commands with the privileges of the Ground Station service.

How does an attacker trigger this vulnerability?

An attacker sends a specifically crafted request to the unauthenticated save-waterfall-snapshot command to write a malicious configuration file to the disk. Merely saving a file does not trigger the execution; the attack succeeds only when the attacker uses the update-app-config operation to point the system to their malicious file and subsequently triggers a service restart, causing the application to process the file's contents.

Do I need to worry if my Ground Station instance is internal?

Halo Surface Signal notes that Ground Station is typically deployed as a web-accessible server for remote management, making internet-facing exposure common. While internet-facing instances are at higher risk of external exploitation, internal instances remain vulnerable if an attacker gains access to your local network. You should prioritize securing all instances regardless of location.

When should I update my software to fix this?

You should update to version 0.4.13 or later immediately. The first step is to locate all installations of Ground Station within your environment. Once identified, verify their network accessibility and apply the update to patch the input handling logic that allows the unauthorized file writes and subsequent configuration hijacking.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.