CVE-2026-60112: falha crítica em NASA-AMMOS AIT-GUI
AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
NASA-AMMOS · AIT-GUIReferências
https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.mdhttps://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726dhttps://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create