Ait Dsn
Monthly
Unauthenticated API access in NASA AMMOS Instrument Toolkit (AIT) Deep Space Network Interface before 2.2.2 lets remote attackers control spacecraft communication sessions with no credentials. Seven Space Link Extension (SLE) interface-manager routes are exposed without any authentication, allowing an attacker to start or stop Deep Space Network sessions, read telemetry frame data, and inject arbitrary frames into active spacecraft links. Reported by VulnCheck and rated CVSS 4.0 9.3; no public exploit is identified at time of analysis, but the missing-auth flaw is trivially reachable over the network.
Unauthenticated API access in NASA AMMOS Instrument Toolkit (AIT) Deep Space Network Interface before 2.2.2 lets remote attackers control spacecraft communication sessions with no credentials. Seven Space Link Extension (SLE) interface-manager routes are exposed without any authentication, allowing an attacker to start or stop Deep Space Network sessions, read telemetry frame data, and inject arbitrary frames into active spacecraft links. Reported by VulnCheck and rated CVSS 4.0 9.3; no public exploit is identified at time of analysis, but the missing-auth flaw is trivially reachable over the network.