CVE-2026-60112

Analyzed Analyzed - Analysis Complete

Unauthenticated Command Execution in AMMOS Instrument Toolkit GUI

Publication date: 2026-07-29

Last updated on: 2026-08-18

Assigner: VulnCheck

Description

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-60112

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	ait_gui	to 2.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authentication flaw in AMMOS Instrument Toolkit (AIT) GUI versions before 2.5.1. It allows unauthenticated attackers to create valid sessions and issue arbitrary spacecraft commands by exploiting the Sessions.create() function without credential checks. Attackers can then use handle_cmd() to send commands directly to the AIT command bus.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthenticated calls to Sessions.create() in AIT GUI versions before 2.5.1. Check logs for arbitrary command execution via handle_cmd(). Use network scanners to identify AIT GUI instances and verify their version.

Impact Analysis

An attacker could gain full control over spacecraft systems, issue unauthorized commands, disrupt operations, or cause damage. This could lead to mission failure, data breaches, or safety hazards depending on the system's purpose.

Compliance Impact

This vulnerability allows unauthenticated attackers to issue arbitrary spacecraft commands, which could lead to unauthorized access and control of systems. For compliance standards like GDPR and HIPAA, which require strict access controls and data protection, this flaw could result in unauthorized data exposure or system manipulation, violating confidentiality and integrity requirements.

Mitigation Strategies

Upgrade AIT GUI to version 2.5.1 or later to address the missing authentication vulnerability in Sessions.create(). Ensure no unauthenticated sessions are active and review command logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-60112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70