Which versions of AIT-DSN are affected by CVE-2026-60113?

NASA AMMOS Instrument Toolkit Deep Space Network Interface versions before 2.2.2 contain an unauthenticated API flaw allowing remote attackers to intercept, read, and manipulate active spacecraft…. A patch is available.

How to fix or mitigate CVE-2026-60113?

Within 24 hours: Identify all systems running NASA AIT Deep Space Network Interface versions prior to 2.2.2 and immediately restrict network access to affected SLE interface-manager endpoints through firewall rules or access controls. Within 7 days: Apply vendor-released patch 2.2.2 to all affected instances following change management procedures appropriate for mission-critical Deep Space Network infrastructure. Within 30 days: Audit Deep Space Network session logs from the past 90 days for unauthorized access patterns, implement authentication enforcement on all SLE interface routes, and establish continuous monitoring for anomalous API calls.

AIT-DSN CVE-2026-60113

Q: What is the CVSS score of CVE-2026-60113?

CVE-2026-60113 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50397 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-29 VulnCheck

Authentication Bypass Ait Dsn Nasa Ammos

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Seven routes reachable over the network with no credentials (AV:N/PR:N/AC:L/UI:N); telemetry exposure, frame injection, and session control give full C/I/A impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 16:27 vuln.today

Analysis Generated

Jul 29, 2026 - 16:27 vuln.today

CVE Published

Jul 29, 2026 - 15:40 cve.org

CRITICAL 9.3

DescriptionCVE.org

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

AnalysisAI

Unauthenticated API access in NASA AMMOS Instrument Toolkit (AIT) Deep Space Network Interface before 2.2.2 lets remote attackers control spacecraft communication sessions with no credentials. Seven Space Link Extension (SLE) interface-manager routes are exposed without any authentication, allowing an attacker to start or stop Deep Space Network sessions, read telemetry frame data, and inject arbitrary frames into active spacecraft links. Reported by VulnCheck and rated CVSS 4.0 9.3; no public exploit is identified at time of analysis, but the missing-auth flaw is trivially reachable over the network.

Technical ContextAI

AIT-DSN is NASA AMMOS's open-source Python toolkit that implements the CCSDS Space Link Extension (SLE) protocol services (RAF, RCF, CLTU, etc.) used to bridge mission ground systems with Deep Space Network antenna stations for spacecraft telemetry and commanding. The defect is CWE-306 (Missing Authentication for Critical Function): the SLE interface manager exposes an HTTP API whose seven routes perform security-critical operations - session lifecycle control, telemetry retrieval, and frame injection - but enforce no credential check, so any client that can reach the listener is treated as authorized. The affected component is identified by CPE cpe:2.3:a:nasa-ammos:ait-dsn:*, covering all releases prior to 2.2.2.

RemediationAI

Upgrade to AIT-DSN 2.2.2 or later, which addresses the missing authentication on the SLE interface-manager routes; this is a vendor-released patch (release tag 2.2.2, fix commit 06d07d1a525602c62c6eaeaeff2544196f430340, https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2). Review the advisory GHSA-gj83-67wr-82mv before deploying. Until 2.2.2 is applied, restrict network reachability of the SLE interface manager: bind the API listener to localhost or a dedicated management interface, and place firewall/ACL rules that permit only known mission-operations hosts to reach the API port, accepting that this breaks any legitimate remote clients that were relying on open access. Because the routes control live Deep Space Network sessions and frame injection, avoid exposing the service to any untrusted or general enterprise network segment, and monitor the endpoints for unexpected session start/stop or frame-injection requests as a detective control.