CVE-2026-47731

Name of the Vulnerable Software and Affected Versions AIT-Core versions prior to 3.1.1 AIT-Core versions 2.x prior to 2.6.1

Description The Binary Stream Capture (BSC) component features an unauthenticated HTTP API for creating packet capture handlers. The system blindly trusts path-related form fields, allowing a remote client to bypass the configured log root and direct the software to log to arbitrary filesystem paths. This enables an attacker to append controlled data to files using the privileges of the ait-bsc process, which could lead to data corruption or Remote Code Execution if executable scripts are modified.

Technical details include:

Exploitation can occur directly if the server is network-accessible or indirectly via a cross-site request if a user in the local network visits an attacker-controlled website. Additionally, a bug in the TCP handler may cause an infinite loop of data writing after a connection is closed, potentially exhausting disk space.

Recommendations Upgrade AIT-Core to version 3.1.1. Upgrade AIT-Core to version 2.6.1. Restrict access to the /<name>/start endpoint to trusted networks or implement HTTP authentication. Use a dedicated, non-world-writable directory for BSC logs instead of /tmp. As a temporary mitigation, restrict the use of the path and log dir path parameters in REST calls.