55
42
55
30
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.
50
NASA Ground Control Software Flaw Enables Unauthenticated Commands
Critical flaws in NASA's AIT-GUI ground control software let unauthenticated attackers send spacecraft commands and execute scripts.
NASA's AIT-GUI ground control software contains critical flaws that expose spacecraft command and script execution to unauthenticated attackers. Anyone able to reach the ground control interface could send unauthorized commands without valid credentials. The report does not indicate that the flaws have been exploited in the wild.
62
55
60
55
30
55
30
55
55
30
55
55
42
30
30
30
42
55
30
30
30
42
42
60
35
55
30
55
55
42
55
57
55
42
55