gpsd Open Source Project

An attacker with network access to a device running vulnerable gpsd could execute arbitrary code on the device, potentially exfiltrating data or crashing it. If gpsd controls or monitors critical infrastructure sensors or navigation, this could disrupt operations.

Any system or device running gpsd (a GPS daemon commonly used in industrial control systems, maritime navigation, time synchronization appliances, and autonomous vehicles) versions 2.90 through 3.17 is affected. This includes embedded navigation systems, precision timing modules, and any telemetry or location-aware ICS component that depends on gpsd or the microjson library. Critical infrastructure operators relying on GPS-synchronized systems (power grid, water systems, telecommunications) should assess whether gpsd is in use in their environment.

An attacker on an adjacent network sends a specially crafted message to the gpsd service (typically listening on port 2947). The vulnerability is a stack buffer overflow in microjson parsing. If gpsd is reachable from a network segment accessible to an attacker, malicious GPS/NMEA protocol messages could trigger code execution. High skill is required to construct the payload.