CVE-2026-53985 is a CWE-306 Missing Authentication vulnerability affecting Efstratios Goudelis Ground Station versions before 0.6.0. The Socket.IO server listens on port 7000 with disabled authentication and a wildcard CORS policy, allowing unauthenticated attackers to emit the service_control event with a restart_service command. This command forcibly terminates the ground-station process, disrupting all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. The vulnerability can be repeatedly triggered, especially in Docker deployments, leading to persistent denial-of-service conditions. The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or remediation level has been published as of the data provided.

An unauthenticated attacker can remotely cause a denial-of-service by terminating the ground-station process, disrupting critical satellite tracking and signal processing functions. This results in loss of service availability and potentially impacts operations relying on the Ground Station software. The vulnerability does not require user interaction or privileges and can be exploited over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Socket.IO server port 7000 to trusted users only. Implement network-level controls such as firewall rules or VPNs to prevent unauthorized access. Monitor for unusual restart_service event activity if possible.