ground-station: Authentication bypass in setup.restore allows full takeover

Summary

The ground-station suite for satellite tracking and SDR reception contains an authentication bypass in the setup.restore command. While an instance is in first-run setup mode and no administrator exists yet, an unauthenticated attacker can send a crafted SQL dump via Socket.IO, which is executed as a full database restore. The attacker can then create an administrator account and a forged session token, gaining complete control over the application and its data.

Affected

• ground-station versions up to and including 0.7.19 (vendor advisory GHSA-3mqj-q84c-crjq)
• The CNA record (VulnCheck) lists versions before 0.8.0. This differs from the vendor data and has not been resolved.

Fixed in

• Vendor advisory: patched in 0.8.3
• CNA record: fixed in 0.8.0
• Install the latest release.

Workaround

• Complete the initial setup on every instance so that the first-run setup mode is no longer reachable.
• Do not expose the web or Socket.IO port to the internet. Restrict access to a VPN or internal network.
• No vendor workaround is documented. Third-party sources recommend requiring authentication for setup.restore.

Exploitation

• CISA SSVC assessment: exploitation 'poc' (proof of concept available), automatable: yes.
• No evidence of active exploitation found. CISA KEV status was not checked.
• Public PoC references exist but have not been verified.

Our recommendation

• Upgrade to version 0.8.3 or later, preferably the latest release.
• Check whether any instance is reachable from the internet or untrusted networks, and whether its setup has been completed.
• If a vulnerable instance was reachable during setup, review the database for unknown users and sessions and rotate credentials.
• Review the product's other unauthenticated Socket.IO handlers, as several similar issues have been reported recently.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-3mqj-q84c-crjq github.com
• Fix commit 940df21 github.com
• VulnCheck advisory www.vulncheck.com
• CVE record (CVE List V5) raw.githubusercontent.com
• OSV entry CVE-2026-103244 osv.dev
• OpenCVE CVE-2026-103244 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:42.