CISA 2026-07-02

CubeSpace CW0057 Reaction Wheel

CVE-2026-13743

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires physical access to upload malicious firmware, and the device can be recovered using the independent bootloader.

Context

The CubeSpace CW0057 Reaction Wheel is a hardware component used in systems requiring precise attitude control. The advisory states that firmware versions prior to 5.0.20 lack proper cryptographic signature verification, allowing unauthorized firmware uploads if an attacker has physical access. Firmware version 5.0.20 introduces cryptographically verified secure boot, but this feature is not enabled by default. Recovery is possible via the bootloader, which remains isolated from the application firmware.

Operator considerations

Check: inventory all CubeSpace CW0057 Reaction Wheel devices and verify current firmware versions.
Patch: upgrade to firmware version 5.0.20 and enable signed-boot functionality, particularly fully immutable mode.
Isolate: restrict physical access to the devices to prevent unauthorized firmware modifications.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary malicious firmware to the device.

The following versions of CubeSpace CW0057 Reaction Wheel are affected:

CW0057 Reaction Wheel

Vendor

Equipment

CubeSpace

CubeSpace CW0057 Reaction Wheel

Improper Verification of Cryptographic Signature

Critical Infrastructure Sectors: Communications

Countries/Areas Deployed: Worldwide

Company Headquarters Location: South Africa

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication.

CubeSpace CW0057 Reaction Wheel

Read the full advisory on CISA →