🔍 Ground Segment Vulnerability Sweep — Findings
7 critical · 192.168.100.1/24
CRITICAL
Telnet (Port 23) OPEN — Cleartext credentials
192.168.100.1 · T1040 Network Sniffing
→ Disable telnet; deploy SSH (Ed25519)
CRITICAL
FTP Anonymous Write (Port 21) OPEN
192.168.100.15 · T1190 Exploit Public-Facing App
→ Disable FTP; deploy SFTP chroot
CRITICAL
HTTP Admin Panel (Port 80) — Unencrypted
Both hosts · T1557 Adversary-in-the-Middle
→ Redirect to HTTPS (TLS 1.3)
CRITICAL
CVE-2026-3392 TR-069 CWMP — Unsigned provisioning
192.168.100.1 · T1542.001 Pre-OS Boot
→ Disable CWMP or enforce mutual TLS
CRITICAL
Unsigned Firmware Accepted — Arbitrary partition overwrite
192.168.100.1 · T1542.001 Firmware Integrity
→ Enable firmware signature verification (ML-DSA-65)
CRITICAL
UART/JTAG Hardware Console — Unauthenticated
192.168.100.1 · T1200 Hardware Additions
→ Physically secure debug headers
HIGH
SNR 5.9 dB / Clock Skew +55.1 Hz — Below threshold
RF Link · T1565.001 Data Manipulation
→ Resync GPS/NTP; inspect OCXO oscillator
📡 RF Link Health
⚠ DEGRADED
5.9
SNR (dB)
CRITICAL <8.0
35.0
BUC Temp °C
NOMINAL
0.00
PLR %
NOMINAL
+55.1
Clock Skew Hz
CRITICAL >±10
🔐 PQC Readiness
42.8% · FIPS 203/204/205
ML-KEM-768✅ FIPS 203
ML-DSA-65⚠ PARTIAL
SLH-DSA✅ FIPS 205
RSA-2048❌ LEGACY
ECC-P256❌ LEGACY
QKD BB84❌ QBER 40%
⚡ Sweep Terminal Log
PHASE 0–5 COMPLETE · 7 findings
[*] Target Subnet: 192.168.100.1/24 | Profile: DEEP
[*] PHASE 0: Network Discovery...
[+] Host 192.168.100.1 — VSAT Ground Terminal Modulator Hub
[+] Host 192.168.100.15 — Network Operations Center Console
[*] PHASE 1: Probing TCP/UDP Control Sockets...
[!!!] Port 21 (FTP): OPEN — Anonymous read/write enabled!
[!!!] Port 23 (Telnet): OPEN — Cleartext credentials visible!
[!!!] Port 80 (HTTP): OPEN — Unencrypted admin panel!
[✓] Port 161 (SNMP): SNMPv3 auth enforced — SECURE
[*] PHASE 2: Auditing TR-069 CWMP (Port 7547)...
[!] Port 7547 (TR-069): Exposed to incoming networks
[!!!] CVE-2026-3392: Unsigned CWMP provisioning accepted — VULNERABLE!
[*] PHASE 3: Cryptographic Audit...
[!!!] Unsigned firmware accepted — Arbitrary partition overwrite threat!
[*] PHASE 4: Hardware Debug Audit (JTAG/UART)...
[!!!] UART pins unauthenticated — Device registers readable!
[*] PHASE 5: RF Carrier Telemetry...
[!!!] Carrier SNR: 5.9 dB — CRITICAL (threshold: 8.0 dB)
[!!!] Clock Skew: +55.1 Hz — CRITICAL (threshold: ±10 Hz)
[✓] Sweep complete. 7 critical findings. See findings table.