Executive Summary

A critical vulnerability, CVE-2026-60112, has been identified in the AMMOS Instrument Toolkit (AIT) GUI versions prior to 2.5.1. This vulnerability allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. The vulnerability has a CVSS score of 9.8, indicating a high severity level.

Technical Analysis

The vulnerability is classified as a missing authentication vulnerability. The attack vector involves calling the `Sessions.create()` method without any credential check, allowing an attacker to obtain a valid session. Subsequently, the attacker can invoke the `handle_cmd()` method to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch. The root cause of this vulnerability is the lack of authentication and authorization checks in the session creation process.

How It Gets Exploited

An unauthenticated remote attacker on the same network can exploit this vulnerability by sending a crafted request to the `Sessions.create()` method. This would allow the attacker to obtain a valid session without providing any credentials. Once a valid session is obtained, the attacker can invoke the `handle_cmd()` method to forward arbitrary commands to the AIT command bus, effectively allowing them to issue arbitrary spacecraft commands. This could lead to a complete compromise of the spacecraft's command and control systems.

Impact Assessment

The AMMOS Instrument Toolkit (AIT) GUI versions prior to 2.5.1 are affected by this vulnerability. An attacker can achieve arbitrary command execution, confidentiality impact, integrity impact, and availability impact. The CVSS score of 9.8 indicates a critical severity level.

Recommended Actions

To mitigate this vulnerability, update the AMMOS Instrument Toolkit (AIT) GUI to version 2.5.1 or later. Additionally, implement network segmentation and access controls to restrict access to the AIT GUI. Monitor for suspicious activity and implement intrusion detection systems to detect potential exploitation attempts.

Sources

- National Vulnerability Database (NVD) - Vulncheck