A critical missing authentication vulnerability in NASA fprime-gds permits unauthenticated remote attackers to gain arbitrary code execution and send unauthorized commands to connected spacecraft.

The application lacks authentication checks across its Flask endpoints, providing unauthenticated remote attackers full access to critical ground station functions and spacecraft command interfaces.

Exploitation of this vulnerability allows unauthorized actors to seize control of ground station operations and potentially interfere with connected spacecraft hardware. Given the CVSS score of 9.8, the risk involves both the compromise of the ground station host and the potential for physical or mission-critical impact through unauthorized command injection.

Immediate Action: Immediately restrict access to the fprime-gds service to trusted internal networks only, as no patch is currently available to resolve the missing authentication flaw.

Proactive Monitoring: Monitor all traffic to the Flask application and audit logs for any unauthorized command execution or attempts to access administrative endpoints.

Compensating Controls: Deploy a robust network-level authentication proxy or VPN to ensure that only authorized personnel can reach the application interface.

Public Exploit Available: Unknown

This vulnerability represents a critical security failure due to the total absence of access controls on a highly sensitive system. Until a patch is provided, the application must be removed from any network accessible by untrusted users to prevent unauthorized command injection and remote code execution.