CVE-2013-6035: BGAN Satellite Terminal Firmware Unauthenticated Privileged-Protocol Remote Code Execution

CVE-2013-6035 is a missing-authentication vulnerability (CWE-306) in firmware developed by Hughes Network Systems and licensed into multiple vendors' BGAN satellite terminals, including Japan Radio Corp.'s JUE-250 and JUE-500 units used aboard ships and in other mobile applications: the firmware accepts unauthenticated connections on TCP port 1827 over an insecure proprietary protocol that can read and write arbitrary device memory, letting an unauthenticated attacker on the terminal's local network execute arbitrary code, and NVD's own Primary analysis scores the flaw 10.0 (critical) on CVSS v2 — CERT/CC additionally states it is unaware of any practical fix.

CVE-2013-6035 (CWE-306, Missing Authentication for Critical Function) affects firmware that CERT/CC confirms was developed by Hughes Network Systems and is shared, under license, across several vendors' Broadband Global Area Network (BGAN) satellite terminals. NVD's description states: "The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201, 9450, and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals does not require authentication for sessions on TCP port 1827, which allows remote attackers to execute arbitrary code via unspecified protocol operations" (NVD).

CERT/CC's vulnerability note VU#250358 adds the technical detail NVD's one-line description does not spell out: "these devices accept unauthenticated connections on TCP port 1827 from the local ethernet port. This port utilizes an insecure proprietary protocol which can be used to perform privileged operations on the device, such as reading and writing arbitrary memory. An unauthenticated local attacker could leverage this protocol to execute arbitrary code on vulnerable devices" (CERT/CC VU#250358). Of the named vendors, Japan Radio Corp.'s JUE-250 and JUE-500 are BGAN terminals marketed for marine and other mobile satellite communication use; CERT/CC's note lists Harris Corporation and Hughes Network Systems as confirmed "Affected," Inmarsat and GateHouse as "Not Affected" (GateHouse supplies the BGAN network stack the vulnerable firmware is built on, but CERT/CC confirms "the GateHouse software does not provide either of the vulnerable features"), and records no vendor statement on file for Japan Radio or Thuraya.

Harris Corporation's own vendor statement, reproduced on CERT/CC's note, argues the practical risk is bounded in its tactical radio product: "physical access to the RF-7800B terminal is required under the scenarios defined in the report" and "it is not possible to gain access to the BGAN SATCOM terminal over a wireless satellite link" (CERT/CC VU#250358); CERT/CC's note does not record an equivalent statement scoping the risk for the Japan Radio JUE-250/JUE-500 terminals this page focuses on.

NVD has completed its own severity analysis for this CVE: the Primary score (source [email protected]) is CVSS v2 10.0 (the maximum on that scale), vector AV:N/AC:L/Au:N/C:C/I:C/A:C (NVD). CERT/CC's own impact statement is narrower and conditional: "depending on implementation, an unauthenticated attacker may be able to gain privileged access to the device," and separately, "an unauthenticated attacker on the local network may be able to execute arbitrary code on the device" — NVD's AV:N (network) vector reflects the TCP/1827 listener itself, while real-world exploitability still depends on whether an attacker can reach that port, typically requiring access to the terminal's local Ethernet segment rather than the satellite link itself.

CERT/CC's solution guidance is unchanged since 2014: "We are currently unaware of a practical solution to this problem," and no fixed firmware version is recorded for any of the named vendors as of CERT/CC's last update on 2014-08-14 (CERT/CC VU#250358).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01713 (77.5th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).

With no vendor patch on record over a decade after disclosure, operators of affected BGAN terminals — including Japan Radio JUE-250/JUE-500 units installed aboard vessels — should restrict Ethernet-side network access to the terminal to trusted onboard equipment only, and treat TCP port 1827 as a privileged management interface that must never be reachable from a general crew, passenger or shore-side network.

• The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201, 9450, and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals does not require authentication for sessions on TCP port 1827, which allows remote attackers to execute arbitrary code via unspecified protocol operations. — NVD
• The TCP/1827 listener uses an insecure proprietary protocol that can read and write arbitrary device memory; an unauthenticated local attacker could leverage this protocol to execute arbitrary code; affected terminals include Japan Radio Corp. JUE-250 and JUE-500; GateHouse's BGAN network stack does not itself provide either vulnerable feature. — CERT/CC VU#250358
• Harris Corporation's vendor statement argues physical access to its RF-7800B terminal is required for the reported scenarios, and that it is not possible to gain access over the wireless satellite link itself; CERT/CC records no equivalent statement from Japan Radio Corp. or Thuraya. — CERT/CC VU#250358
• NVD's own Primary CVSS v2 score is 10.0, vector AV:N/AC:L/Au:N/C:C/I:C/A:C; CERT/CC is unaware of any practical solution and records no fixed firmware version for any named vendor as of its last update, 2014-08-14. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01713 (77.5th percentile) as of 2026-11-08. — FIRST EPSS