CVE-2025-70083

An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/jonafk555	Third Party Advisory
https://github.com/OpenSatKit/OpenSatKit	Product
https://github.com/OpenSatKit/OpenSatKit/releases/tag/v2.2.1	Release Notes
https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/dir.c	Product
https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/dir.c#:~:text=strcpy%28DirWithSep	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:opensatkit:opensatkit:2.2.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-11 18:16

Updated : 2026-06-17 10:03

NVD link : CVE-2025-70083

Mitre link : CVE-2025-70083

CVE.ORG link : CVE-2025-70083

JSON object : View

Products Affected

opensatkit

opensatkit

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2025-70083", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70083", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-12T14:54:52.556470Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-11T18:16:06.337", "references": [{"url": "https://gist.github.com/jonafk555", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/OpenSatKit/OpenSatKit", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/OpenSatKit/OpenSatKit/releases/tag/v2.2.1", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/dir.c", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/dir.c#:~:text=strcpy%28DirWithSep", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en OpenSatKit 2.2.1. El campo DirName en el telecomando es proporcionado por el segmento terrestre y debe ser tratado como entrada no confiable. El programa copia DirName en el b\u00fafer local DirWithSep usando strcpy. El tama\u00f1o de este b\u00fafer es OS_MAX_PATH_LEN. Si la longitud de DirName es mayor o igual que OS_MAX_PATH_LEN, ocurre un desbordamiento de b\u00fafer de pila, sobrescribiendo la memoria de pila adyacente. La verificaci\u00f3n de la longitud de la ruta (FileUtil_AppendPathSep) se realiza despu\u00e9s de la operaci\u00f3n strcpy, lo que significa que la validaci\u00f3n ocurre demasiado tarde y no puede evitar el desbordamiento."}], "lastModified": "2026-06-17T10:03:07.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensatkit:opensatkit:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05D04EF6-40EC-44CC-BF6A-05BD079D06A8"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}