The vulnerability in NASA fprime-gds arises from the Flask web application that exposes all endpoints without any authentication. An unauthenticated remote attacker can exploit this to execute arbitrary code on the ground station host and inject arbitrary commands to connected spacecraft. This loss of confidentiality, integrity, and availability means full control of the ground data system can be achieved by anyone who can reach the Flask service.

NASA fprime-gds versions up to and including 3.4.3 are affected. Any deployment of the ground station using these releases is vulnerable, regardless of host environment or network segmentation.

The CVSS score of 9.8 indicates a high‑severity risk, and the lack of authentication combined with exposed network endpoints suggests a high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but its mechanism—unauthenticated remote code execution via a web service—makes it a prime target for adversaries. Attackers can launch the exploit from any network location that can reach the Flask service, making it an internet‑facing risk.