CVE-2026-67673: OreSat Firmware Buffer Overflow Flaw

CVE-2026-67673 Overview

CVE-2026-67673 is a stack-based buffer overflow vulnerability in the cmd_edl function of OreSat Firmware v1.0. The flaw exists in the handler for the edl fw_flash command, which copies the <filename> argument into a fixed 64-byte stack buffer using memcpy without validating the input length. An attacker with physical access to the UART3 serial interface can supply an oversized filename to corrupt the stack, causing a denial of service on the affected embedded device. The weakness is classified under [CWE-121: Stack-based Buffer Overflow].

Critical Impact
Physical attackers can crash the OreSat firmware by sending a crafted edl fw_flash command over UART3, leading to a loss of availability on the satellite platform.

Affected Products

OreSat Firmware v1.0
Systems exposing the UART3 serial interface for engineering data link (EDL) commands
Deployments running the vulnerable cmd_edl command handler

Discovery Timeline

2026-08-03 - CVE-2026-67673 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67673

Vulnerability Analysis

The vulnerability resides in the cmd_edl function that dispatches engineering data link commands received on the UART3 serial interface. When the firmware processes the edl fw_flash <filename> subcommand, it copies the caller-supplied <filename> argument into a 64-byte stack-allocated buffer using memcpy. The copy operation uses the attacker-controlled length rather than a bounded size, so any filename longer than 64 bytes overwrites adjacent stack memory, including saved registers and the return address.

Because OreSat runs on a resource-constrained embedded target, exploitation reliably causes the firmware to fault and halt. The attack requires physical access to the UART3 pins but no authentication and no user interaction. The impact is limited to availability, as the vulnerability does not directly disclose or modify data on the device.

Root Cause

The root cause is missing length validation before a memcpy call in cmd_edl. The command parser trusts the size of the tokenized filename argument and passes it directly to memcpy targeting a fixed 64-byte stack buffer. No bounds check compares the source length against the destination capacity, which is the canonical pattern described in [CWE-121].

Attack Vector

An attacker must connect to the UART3 serial interface exposed by the OreSat hardware. Once connected, the attacker issues an edl fw_flash command with a filename argument exceeding 64 bytes. The oversized copy corrupts the stack frame of cmd_edl, crashing the firmware and forcing a reset or hang. See the GitHub Issue Tracker for the reporter's technical writeup.

Detection Methods for CVE-2026-67673

Indicators of Compromise

Unexpected firmware resets or watchdog-triggered reboots correlated with EDL command activity on UART3.
Serial console logs showing malformed or unusually long edl fw_flash command invocations.
Loss of telemetry or command responsiveness immediately following ground-station EDL sessions.

Detection Strategies

Instrument the EDL command parser to log the length of every <filename> argument and flag values above the 64-byte threshold.
Compare pre- and post-command firmware state through heartbeat telemetry to identify abnormal resets tied to EDL traffic.
Review physical access logs for the ground support equipment and any period of unauthorized UART3 connectivity.

Monitoring Recommendations

Enable persistent serial logging on the UART3 interface during test and integration to capture every command sequence.
Track firmware crash counters and stack canary violations exported through housekeeping telemetry.
Alert on repeated edl fw_flash failures, which may indicate probing for the buffer overflow condition.

How to Mitigate CVE-2026-67673

Immediate Actions Required

Restrict physical access to the UART3 serial header on flight and engineering hardware to authorized personnel only.
Disable or gate the edl fw_flash command in operational builds where firmware flashing over UART is not required.
Audit ground support equipment and test harnesses for scripts that might accidentally send oversized filenames.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the GitHub Issue Tracker for status updates from the OreSat project. Operators should track the upstream repository for a fix that adds an explicit length check before the memcpy in cmd_edl or replaces the copy with a bounded routine such as strlcpy.

Workarounds

Enforce a length check in a local fork of the firmware that rejects any edl fw_flash filename longer than 63 bytes plus a null terminator.
Physically remove or shroud the UART3 header on deployed hardware to prevent opportunistic serial access.
Require multi-person authorization procedures for any ground operation that opens a serial session to the satellite bus.

bash

# Configuration example
# Illustrative bounds check to apply in cmd_edl before memcpy
if (filename_len >= sizeof(filename_buf)) {
    return EDL_ERR_INVALID_ARG;
}
memcpy(filename_buf, filename_arg, filename_len);
filename_buf[filename_len] = '\0';