Description
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.
Affected products
nasa: ait dsn
References6
- github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67w… ExploitVendor Advisory
- github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67w… ExploitVendor Advisory
- github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff… Patch
- www.vulncheck.com/advisories/ait-dsn-missing-authentication-via… PatchRelease NotesThird Party Advisory
- github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---20… Release Notes
- github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2 ProductRelease Notes
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
9.3
CRITICAL
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 58 · as of 13 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.