CVE-2026-60113

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication flaw (CWE-306) in its Space Link Extension (SLE) interface manager, leaving seven API routes accessible without credentials. An unauthenticated network attacker triggers the issue simply by sending direct HTTP requests to the exposed SLE endpoints, requiring no privileges or user interaction. Successful access allows the attacker to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links, potentially disrupting live mission communications. Only operators running AIT DSN Interface versions prior to 2.2.2 with the SLE interface manager reachable over a network are affected. No exploitation has been observed in the wild; the flaw carries a low EPSS score of 0.5% and a public advisory exists on the project's GitHub, but it is not listed in CISA KEV.

What to do: Upgrade AIT DSN Interface to version 2.2.2 or later to restore authentication on the seven SLE API routes. Until patched, restrict network access to the SLE interface manager (firewall rules, VPN, or allowlisting trusted ground-systems hosts) and monitor for unexpected session start/stop events or injected telemetry frames.