CVE-2026-60112

Name of the Vulnerable Software and Affected Versions AMMOS Instrument Toolkit (AIT) GUI versions prior to 2.5.1

Description An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the Sessions.create() function, which fails to perform credential checks. Once a session is established, an attacker can invoke the handle cmd() function to forward arbitrary commands directly to the AIT command bus, as there is no authentication gate between session creation and command dispatch.

Recommendations Update AMMOS Instrument Toolkit (AIT) GUI to version 2.5.1 or later. As a temporary mitigation, restrict network access to the Sessions.create() and handle cmd() functions.