CVE-2026-60112

Katalog CVE

CVSS 9.8 · Critical EPSS 0,79%

Kerentanan Missing Authentication for Critical Function pada nasa ait gui. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d patch
• https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create patch · release notes · advisory pihak ketiga
• https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.md release notes
• https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1 product · release notes