NASA-AMMOS AIT-Core up to 3.1.1 Telemetry/Command Broker missing authentication

Summaryinfo

A vulnerability classified as very critical has been found in NASA-AMMOS AIT-Core up to 3.1.1. This affects an unknown part of the component Telemetry/Command Broker. Performing a manipulation results in missing authentication. This vulnerability is cataloged as CVE-2026-105105. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in NASA-AMMOS AIT-Core up to 3.1.1. It has been classified as very critical. This affects some unknown processing of the component Telemetry/Command Broker. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-105105 since 10/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/03/2026).

Upgrading to version 3.1.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-92014). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• NASA-AMMOS

Name

• AIT-Core

Version

• 3.1.0
• 3.1.1

Website

• Product: https://github.com/NASA-AMMOS/AIT-Core/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion