PT-2024-26305 · Nasa · Nasa Ait-Core

Andy Olchawa + 1 · CVE-2024-35061 · Published 2024-05-21 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NASA AIT-Core version 2.5.2

Description The issue allows attackers to execute a man-in-the-middle attack due to the use of unencrypted channels for data exchange over the network. This can lead to unauthenticated, fully remote code execution when combined with other vulnerabilities.

Recommendations For NASA AIT-Core version 2.5.2, consider implementing encrypted communication channels to prevent man-in-the-middle attacks. As a temporary workaround, restrict network access to trusted sources until a patch is available.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Special Elements Injection

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-74

CWE-311

Related Identifiers

CVE-2024-35061

GHSA-JQFF-8G2V-642H

GHSA-QV6X-53JJ-VW59

PYSEC-2026-1113

Affected Products

Nasa Ait-Core

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35061.json · Exploit
• 🔥 https://linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze · Exploit
• https://osv.dev/vulnerability/GHSA-jqff-8g2v-642h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35059 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35061 · Security Note
• https://osv.dev/vulnerability/GHSA-qv6x-53jj-vw59 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1113 · Vendor Advisory
• https://github.com/NASA-AMMOS/AIT-Core · Note
• https://twitter.com/CVEnew/status/1793284050503041348 · Twitter Post
• https://github.com/advisories/GHSA-qv6x-53jj-vw59 · Note
• https://t.me/cvenotify/80685 · Telegram Post
• https://pypi.org/project/ait-core · Note
• https://github.com/advisories/GHSA-jqff-8g2v-642h · Note
• https://t.me/cvenotify/80749 · Telegram Post