Auth bypass in Nasa Ait Dsn
CVE-2026-60113
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.
Vulnerability class: Broken Authentication
EPSS: 0.005 (42.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Nasa Ait_dsn
- Nasa-ammos Ait-dsn — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, Release Notes)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (release-notes, Product, Release Notes)
- disclosure@vulncheck.com (Exploit, vendor-advisory, Vendor Advisory)
- disclosure@vulncheck.com (Patch, Third Party Advisory, Release Notes, third-party-advisory)
Frequently asked questions
- What is CVE-2026-60113?
- CVE-2026-60113 is a critical-severity vulnerability in Nasa Ait Dsn, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-07-29.
- How severe is CVE-2026-60113?
- Critical severity. CVSS v3 base score is 9.8 out of 10.