An incomplete fix for a prior cFS HS vulnerability leaves a NULL pointer dereference reachable in all versions up to 7.0.1. When an attacker can trigger a specific command under the conditions described, the Health & Safety application will crash, causing a denial‑of‑service that can force the flight computer to reset. The flaw is a classic null‑pointer dereference (CWE-476) and does not directly affect confidentiality, but the crash may disrupt mission‑critical operations.

The affected product is the NASA Core Flight System (cFS) Health & Safety (HS) Application. All installed instances running version 7.0.1 or earlier are at risk. No other vendors or product lines are listed as affected.

The CVSS score of 8.2 indicates a high severity vulnerability. EPSS is < 1%, indicating a very low likelihood of exploitation. The vulnerability does not list a KEV status. Because the flaw is triggered by a specific command, the attack vector is likely local or internal; however, if the command interface is exposed over a network, a remote attacker could also succeed. NASA has issued an official workaround while a formal patch is under development.