CVE-2026-71289

Name of the Vulnerable Software and Affected Versions NASA-AMMOS Asynchronous Network Management System (ANMS) (affected versions not specified) JHUAPL-DTNMA/dtnma-tools (affected versions not specified)

Description The reference implementation of the Asynchronous Network Management System (ANMS) contains a configuration issue where the amp-manager service REST API is published directly to the host network interface on port 8089. This configuration bypasses the Configuration and Access Manager (CAM) gateway, which serves as the system's only authentication boundary. The underlying REST server, implemented with CivetWeb in dtnma-tools (specifically in src/refdm/nm rest.c), has the enable auth domain check setting disabled and uses a null authentication callback for all routes. This allows any network-reachable client to enumerate registered agents, clear stored reports, and submit arbitrary command sets to agents via the .../agents/{eid|idx}/send endpoint, which forwards EXECSET-encoded command sets to registered DTNMA agents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.