Missing authentication and IPv6 wildcard UDP bind in NASA AMMOS AIT-DSN (CVE-2026-60113)

The CLTU UDP listener in AIT-DSN's Space Link Extension (SLE) interface manager binds to the IPv6 wildcard address `::` instead of the operator-configured host, accepting traffic from any network interface on dual-stack hosts regardless of the configured `host=127.0.0.1` setting. The UDP listener applies no authentication to received bytes, which are appended directly to the CLTU upload queue without validation; additionally, seven SLE API routes are reachable with no credentials via direct HTTP requests. Unauthenticated network attackers can start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links. Affected versions: - commit b8c03c6 on master branch - PyPI version 2.0.0 predates this vulnerability) We recommend updating to: 2.2.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv Details: https://vuln.today/cve/CVE-2026-60113