anonhaven

CVE-2026-60113

CRITICAL CVSS 4.0: 9.3 EPSS 0.41%
Updated Jul 30, 2026
AMMOS
Parameter Value
CVSS 9.3 (CRITICAL)
Affected Versions before 2.2.2
Type CWE-306 (Missing Authentication for Critical Function)
Vendor AMMOS
Public PoC No

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v4.0

Weakness Type (CWE)

CWE-306 Missing Authentication for Critical Function

References 5

https://github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13
disclosure@vulncheck.com
https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f…
disclosure@vulncheck.com
https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2
disclosure@vulncheck.com
https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api…
disclosure@vulncheck.com
Share Post Share Share Share