CVE-2025-46673 - NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS)

Back Back to CVE browser

CRITICAL

NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS)

Published Apr 27, 2025

9.9

CRITICAL

CVSS 3.1

EPSS 0.50%

Description

NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS).

Affected products

Vendor NASA Product CryptoLib Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NASA

CryptoLib

unaffected

Version	Status	Constraints
0	affected	<1.3.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-913

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12473
Advisory
https://github.com/nasa/CryptoLib/compare/v1.3.0...v1.3.1
Product
https://github.com/nasa/CryptoLib/compare/v1.3.1...v1.3.2
Product
https://github.com/nasa/CryptoLib/pull/286
Product
https://github.com/nasa/CryptoLib/pull/306
Product
https://securitybynature.fr/post/hacking-cryptolib/
exploitPress/Media Coverage

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12473		Advisory
https://github.com/nasa/CryptoLib/compare/v1.3.0...v1.3.1		Product
https://github.com/nasa/CryptoLib/compare/v1.3.1...v1.3.2		Product
https://github.com/nasa/CryptoLib/pull/286		Product
https://github.com/nasa/CryptoLib/pull/306		Product
https://securitybynature.fr/post/hacking-cryptolib/		exploitPress/Media Coverage