PT-2025-39207 · Cryptolib · Cryptolib

Luiginoc · Published 2025-09-23 · Updated 2025-11-29 · CVE-2025-59534

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.2

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for secure communications between spacecraft and ground stations. A command injection issue exists in the

initialize kerberos keytab file login()

function due to the direct interpolation of user-controlled input into a shell command executed via the

system()

function without proper sanitization or validation. This allows for potential unauthorized command execution.

Recommendations Update CryptoLib to version 1.4.2 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-59534

GHSA-JW5C-58HR-M3V3

Affected Products

Cryptolib

References · 12

• https://github.com/nasa/CryptoLib/security/advisories/GHSA-jw5c-58hr-m3v3 · Vendor Advisory
• https://github.com/nasa/CryptoLib/commit/3ccb1b306026bb20a028fbfdcf18935f7345ed2f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59534 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59534 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1p9mbgi/top_10_trending_cves_29112025 · Reddit Post
• https://t.me/cKure/16638 · Telegram Post
• https://twitter.com/stanislavfort/status/1994467036747948102 · Twitter Post
• https://t.me/cveNotify/137861 · Telegram Post
• https://t.me/CVEtracker/33194 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1970674980632383864 · Twitter Post
• https://twitter.com/CVEnew/status/1970621787320000857 · Twitter Post
• https://twitter.com/blackorbird/status/1994427591223312798 · Twitter Post