by Kastro
Paper/Archive/CVE-2026-60113

CVE-2026-60113

NASA-AMMOS AIT-DSN — AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.6.577 × 2011.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

Affected

ProductAffectedFixed inSource
AIT-DSN< 2.2.22.2.2CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2refgithub.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13exploitgithub.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mvpatchgithub.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340writeupvulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes