Ground Station before 0.6.0 allows any network peer to reach the Socket.IO endpoint on port 7000 without authentication and to emit a database_backup event that executes a caller‑supplied SQL blob. The vulnerability removes all existing tables and recreates them from malicious CREATE TABLE and INSERT statements, destroying satellite, hardware, and schedule data or inserting fabricated entries that redirect the system to attacker‑controlled servers. The flaw is a missing authentication check (CWE‑306) and has a CVSS score of 8.8, indicating a high severity of data loss and integrity compromise.

The product Ground Station by Efstratios Goudelis is affected in all releases prior to version 0.6.0. The database is SQLite and can be fully overwritten or populated with attacker‑controlled data. Organizations running any pre‑0.6.0 instance of this software are at risk.

The vulnerability is exploitable remotely via the unprotected Socket.IO endpoint. No EPSS is available, but the CVSS rating shows significant risk. The system is listed as not in the CISA KEV catalog, yet the lack of authentication and permissive CORS policy means an attacker can trigger the destructive payload from anywhere on the network without prior compromise. Because the database operation is performed with raw execution privileges, the attacker can achieve complete loss of data or subvert future operations.