CVE-2026-60113
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2 has a missing authentication vulnerability in the Space Link Extension (SLE) interface manager. An unauthenticated network attacker can access seven unprotected API routes to manage communication sessions, retrieve telemetry data, and inject frames into active links.
Risk Assessment
An attacker can disrupt communication with spacecraft, intercept telemetry data, or inject malicious frames, jeopardizing space missions.
Recommendation
Update AIT DSN Interface to version 2.2.2 or later, which adds authentication for API routes.
Original NVD description (English source)
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.