CVE-2026-60112
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
AMMOS Instrument Toolkit (AIT) GUI before version 2.5.1 has a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without credential checks.
Risk Assessment
An attacker can take control of a spacecraft by issuing unauthorized commands, potentially leading to catastrophic mission consequences.
Recommendation
Update AIT GUI to version 2.5.1 or later, which adds authentication for session creation.
Original NVD description (English source)
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.