Attacker requests can trigger processor resets or crashes in NASA Core Flight System
Two vulnerabilities in the NASA Core Flight System (cFS) Health and Safety application can trigger a processor reset or application crash. These flaws allow an attacker to cause a denial-of-service condition by sending specific requests. Update your cFS components immediately to mitigate these risks.
Summary
The NASA Core Flight System (cFS) Health and Safety (HS) application contains two high-severity vulnerabilities that can lead to system instability or total processor resets. The HS application, which functions as a plugin for the Core Flight Executive (cFE), is responsible for critical tasks such as hardware watchdog servicing, event monitoring, and CPU aliveness indication.
Exploitation of these flaws allows an attacker to disrupt flight software operations by triggering segmentation faults or NULL pointer dereferences. While no public exploitation targeting these specific vulnerabilities has been reported to CISA, the impact on satellite data systems or other embedded platforms using this framework could be significant.
Technical details
The first vulnerability, CVE-2026-15352, involves a flaw where the HS application crashes via a segmentation fault when processing a routine Housekeeping Telemetry request. This failure results in a denial-of-service condition for the application.
A second, related vulnerability, CVE-2026-18064, stems from an incomplete fix for the initial issue. In versions through 7.0.1, a separate NULL pointer dereference remains reachable within the HS application. If an attacker can trigger this specific command under certain conditions, it results in a denial-of-service and a subsequent processor reset.
The HS application is written in C and relies on the cFS Operating System Abstraction Layer (OSAL) and cFE components. Because these vulnerabilities occur at the application level within the flight software framework, they can impact any embedded system running the cFS platform.
Affected products and fixed versions
The vulnerabilities affect the NASA Core Flight System (cFS) Health and Safety (HS) application.
| CVE | Severity | Affected Versions | Status |
|---|---|---|---|
| CVE-2026-15352 | High (7.5) | Through 7.0.1 | Vulnerable to segmentation fault |
| CVE-2026-18064 | High (7.5) | Through 7.0.1 | Vulnerable to NULL pointer dereference |
Defender guidance
Defenders should prioritize updating the cFS framework and its associated applications. The HS application is a core component used for monitoring hardware watchdogs and CPU status; therefore, ensuring the integrity of this plugin is vital for system uptime.
To minimize exposure, implement the following network-level controls:
- Isolate control system networks from business networks using firewalls.
- Ensure all control system devices are not accessible directly from the internet.
- Use secure remote access methods, such as Virtual Private Networks (VPNs), to manage these systems.
Organizations should perform impact analysis to determine how a processor reset or application crash would affect their specific mission or hardware deployment before applying updates.
Sources
