CVE-2025-46674 Details
Description
NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle.
A vulnerability in NASA CryptoLib versions prior to 1.3.2 allows for the exploitation of Extended Procedures within the Space Data Link Security (SDLS) protocol implementation. This issue arises from the improper management of Security Associations (SAs), which are crucial for maintaining secure communications between ground control and spacecraft. The vulnerability can be exploited to bypass SDLS protections, sending arbitrary telecommands to a spacecraft's Onboard Computer (OBC) and potentially gaining exclusive control over the spacecraft.
Users can update to NASA CryptoLib version 1.3.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://securitybynature.fr/post/hacking-cryptolib/ | CISA-ADP | ExploitPress/Media Coverage |
| https://github.com/nasa/CryptoLib/compare/v1.3.1...v1.3.2 | [email protected] | Product |
| https://github.com/nasa/CryptoLib/pull/365 | [email protected] | Patch |
| https://securitybynature.fr/post/hacking-cryptolib/ | [email protected] | ExploitPress/Media Coverage |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
| CWE-489 | Active Debug Code | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nasa cryptolib | < 1.3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2025 | Initial Analysis | [email protected] |
| Apr 28, 2025 | CVE Modified | CISA-ADP |
| Apr 27, 2025 | New CVE Received | [email protected] |