CVE-2026-105105 in AIT-Core
Summary
by MITRE • 10/03/2026
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified as CWE-306, Missing Authentication for Critical Function, affects the ait.core.server telemetry and command broker component within NASA-AMMOS AIT-Core versions through 3.1.1. This security flaw stems from a fundamental misconfiguration in how the ZeroMQ message bus is bound to network interfaces. Specifically, the XSUB and XPUB sockets are configured by default to bind to all available network interfaces rather than restricting access to local loopback addresses. This architectural decision exposes critical spacecraft command and telemetry infrastructure directly to any entity capable of reaching the associated TCP ports on the host machine or across the network segment where the service is deployed. The absence of authentication mechanisms means that there are no credentials required to interact with these sockets, allowing any remote actor with basic network connectivity to engage with the broker without verification of identity or authorization.
The operational impact of this vulnerability is severe due to the critical nature of the functions exposed. An unauthenticated attacker who gains access to TCP port 5559 can publish arbitrary messages onto internal topics, most notably the _commands_ topic. In a spacecraft ground station context, command injection allows an adversary to send fabricated control instructions that may be forwarded through the command_stream and emitted on the command-uplink UDP path. This capability enables potential disruption of satellite operations or unauthorized manipulation of spacecraft systems if such commands are not rigorously validated by downstream components before execution. Furthermore, access to TCP port 560 permits subscription to sensitive traffic flowing across the ground bus. An attacker can exfiltrate real-time telemetry data and command logs, leading to a significant compromise of confidentiality regarding mission-critical operational parameters and system states.
Beyond direct control and espionage, this vulnerability facilitates denial-of-service conditions by allowing an adversary to inject forged telemetry or flood the message broker with malicious traffic. This disrupts the integrity of the command and telemetry bus, potentially causing data corruption for legitimate ground systems that rely on accurate sensor readings and status updates. The combination of these capabilities means that a single point of network access can lead to full compromise of availability, confidentiality, and integrity within the affected subsystem. From an attack perspective, this aligns with MITRE ATT&CK techniques related to Command and Control via Remote Services as well as Data Exfiltration over Unencrypted Channels, highlighting how insecure default configurations in specialized industrial control systems can be leveraged for broad operational disruption.
Mitigation strategies must prioritize restricting network exposure immediately. The most effective remediation is upgrading to AIT-Core version 3.1.2 or later, where the developers have corrected this behavior by changing the default ZeroMQ bind addresses to loopback only. This ensures that the message broker remains accessible exclusively from local processes on the host machine, effectively eliminating remote network-based exploitation vectors for unauthenticated users. For environments running older versions where an upgrade is not immediately feasible, administrators should manually configure the socket bindings to restrict access to 127.0.0.1 or implement strict firewall rules that block external TCP traffic to ports 5559 and 5560 unless explicitly required for specific trusted internal services. Additionally, implementing ZeroMQ authentication mechanisms such as CURVE encryption can provide defense-in-depth by ensuring that even if network access is inadvertently granted, only clients with valid cryptographic credentials can interact with the broker.