CVE-2026-60113
AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jul 29, 2026
- Updated
- Jul 30, 2026
- Reserved
- Jul 8, 2026
Description
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
AIT-DSNNASA-AMMOS |
|
References
- Release Notesrelease-notes
- Changelogissue-tracking
- GitHub Security Advisory (GHSA-gj83-67wr-82mv)vendor-advisory
- Patch Commitpatch
- https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.