CVE-2026-60113

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Missing Authentication for Critical Function pada nasa ait dsn. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv exploit · advisory vendor
• https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340 patch
• https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes patch · release notes · advisory pihak ketiga
• https://github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13 release notes
• https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2 product · release notes