PT-2026-65834 · Nasa Ammos · Ait-Gui

Saidakbarxon Maxsudxonov + 1 · CVE-2026-60112 · Publicado 2026-07-29 · Atualizado 2026-07-29

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-60112

Produtos afetados

Ait-Gui

Referências · 5

• https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1 · Nota
• https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.md · Nota
• https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-60112 · Nota de Segurança
• https://vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create · Nota