This vulnerability in NASA HyperCP (main branch) involves OS command injection via intercepted or spoofed responses from the oceandata.sci.gsfc.nasa.gov server. An attacker positioned on the network adjacent to the victim can exploit this flaw to execute arbitrary system commands on the researcher's workstation. The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with attack vector network, attack complexity high, no privileges required, user interaction required, and scope unchanged.

Successful exploitation allows an attacker to execute arbitrary system commands on the researcher's workstation, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, system manipulation, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid interacting with untrusted network responses from oceandata.sci.gsfc.nasa.gov and consider network-level protections to prevent interception or spoofing. Monitor vendor channels for updates.