An unauthenticated denial‑of‑service flaw exists in the Ground Station project before version 0.6.0. The flaw lies in the Socket.IO server’s service_control event handler, which accepts a restart_service command without requiring valid authentication. By sending this single command, an external actor can shut down the ground‑station process, terminating all satellite‑tracking activities, SDR recordings, demodulators, decoders, and rotator controllers.

Ground Station from the developer Efstratios Goudelis, any installations running a version earlier than 0.6.0. This includes deployments running the example Docker image or any custom builds that have not applied the 0.6.0 patch.

The CVSS score is 8.7, signifying a high‑severity vulnerability. No EPSS score is published, and the issue is not listed in the CISA KEV catalog, yet the lack of authentication and permissive CORS mean that any external host can trigger the exploit immediately. In a containerized environment, repeated requests can quickly exhaust resources, making a persistent denial of service possible.