CubeSpace's CW0057 reaction wheel, an attitude-control component flown on small satellites, will accept and install firmware carrying no valid cryptographic signature, according to a CISA advisory published July 2, 2026 and tracked as CVE-2026-13743. The flaw, classified under CWE-347 for improper verification of cryptographic signatures, affects firmware versions earlier than 5.0.20.
A check that confirms the wrong thing
The CW0057's bootloader validates incoming firmware with a CRC-32 checksum rather than a cryptographic signature. A CRC-32 catches accidental corruption, a bit flipped in transit, but it says nothing about who produced the file. An attacker with physical access to the wheel, through its debug or programming interface, could load an unauthorized image with no credentials required.
That mechanism appears in the flaw's NVD entry and in independent technical breakdowns from Security Arsenal and Fieldguide. Researcher Anthony Rose is credited with reporting the vulnerability to CISA.
Why a reaction wheel failing is final
Reaction wheels are the actuators that physically rotate a spacecraft without expending fuel, spinning an internal flywheel to generate torque against the rest of the bus. CubeSpace, based in Stellenbosch, South Africa, lists its CubeWheel line among the attitude-control hardware it has supplied to roughly 130 clients across close to 180 satellite missions, by the company's own count. A satellite that loses fine attitude control cannot reliably point solar panels at the sun, antennas at a ground station, or instruments at a target, a failure mode that can end a mission with no data stolen and no other system compromised. CISA's advisory warns that a failed or malicious firmware flash could disable the wheel outright.
Disagreement over how bad it is
Severity trackers disagree with each other, listing figures as far apart as 3.3 and 6.1 for the same flaw depending on which CVSS version is applied, a split that reflects how differently version 3.1 and version 4.0 weigh a vulnerability that needs hands-on access to exploit. CubeSpace's own position, relayed through Fieldguide's write-up, is that practical risk stays low given that access requirement and a bootloader able to recover a known-good image after a failed update. The company's fix, firmware 5.0.20, adds cryptographic secure boot, though CISA's guidance notes the protection ships disabled by default and has to be turned on, ideally with fully immutable boot configuration, to take effect. CubeSpace has said it will offer an optional hardware security module on future reaction wheel models. No public exploit code has surfaced.
A gap the academic risk models don't fully price in
A separate CubeSat cybersecurity framework published on arXiv in March 2026 by Oxford researcher Jonathan Shelby scores 42 known CubeSat vulnerabilities using STRIDE, MITRE ATT&CK, and CVSS v3.1, and finds that onboard-computing flaws average a CVSS near 6.9, well below the 8.0 to 8.2 average for flaws in communication and ground-segment equipment. The CW0057 bug fits that lower-severity onboard bucket by the numbers, yet it can produce one of the most final outcomes in the register: a dead actuator with no remote recovery path, because it depends on physical access rather than the network-facing vectors those frameworks are built to weigh most heavily.
This story draws on CISA's advisory for CVE-2026-13743, technical write-ups from Security Arsenal and Fieldguide, and Jonathan Shelby's CubeSat risk-assessment paper on arXiv.
