Ait Core
Monthly
Unauthenticated spacecraft command injection and telemetry exfiltration in NASA-AMMOS AIT-Core through 3.1.1: the ait-server ZeroMQ telemetry and command broker binds its XSUB (TCP 5559) and XPUB (TCP 5560) sockets to all network interfaces by default with no authentication or transport security, so any unauthenticated remote attacker with a network path to the ground bus can publish onto internal topics including __commands__, push forged commands through command_stream onto the command-uplink UDP path, subscribe to live command and telemetry traffic, or disrupt the bus outright. The assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated, low-complexity remote exploitation that fully compromises confidentiality, integrity, and availability of the command and telemetry path; no public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV. The exposure is conditional on the shipped default configuration - exploitation requires network reachability to ports 5559 and/or 5560, which is typically an isolated or segmented mission network rather than the public internet - and the fix is AIT-Core 3.1.2, which rebinds these ZeroMQ sockets to loopback by default.
NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated spacecraft command injection and telemetry exfiltration in NASA-AMMOS AIT-Core through 3.1.1: the ait-server ZeroMQ telemetry and command broker binds its XSUB (TCP 5559) and XPUB (TCP 5560) sockets to all network interfaces by default with no authentication or transport security, so any unauthenticated remote attacker with a network path to the ground bus can publish onto internal topics including __commands__, push forged commands through command_stream onto the command-uplink UDP path, subscribe to live command and telemetry traffic, or disrupt the bus outright. The assessed CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting unauthenticated, low-complexity remote exploitation that fully compromises confidentiality, integrity, and availability of the command and telemetry path; no public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV. The exposure is conditional on the shipped default configuration - exploitation requires network reachability to ports 5559 and/or 5560, which is typically an isolated or segmented mission network rather than the public internet - and the fix is AIT-Core 3.1.2, which rebinds these ZeroMQ sockets to loopback by default.
NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.