Ait Gui
Monthly
Missing authentication in NASA-AMMOS AIT-GUI before 2.5.1 lets any unauthenticated network attacker mint a valid session via Sessions.create() and then push arbitrary commands onto the spacecraft command bus through handle_cmd(). Because no credential check gates session creation and no authorization gate sits between session issuance and command dispatch, a remote attacker can issue arbitrary spacecraft commands. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authentication in NASA-AMMOS AIT-GUI before 2.5.1 lets any unauthenticated network attacker mint a valid session via Sessions.create() and then push arbitrary commands onto the spacecraft command bus through handle_cmd(). Because no credential check gates session creation and no authorization gate sits between session issuance and command dispatch, a remote attacker can issue arbitrary spacecraft commands. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.