Critical AMMOS AIT-DSN Flaw Discovered

Security researchers have identified a critical vulnerability in the AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) interface, tracked as CVE-2026-60113. The flaw stems from a missing authentication mechanism in the Space Link Extension (SLE) interface manager, which exposes seven API routes to the public network without requiring any credentials.

What's at Risk

The vulnerability affects all versions of the AIT-DSN interface prior to 2.2.2. Organizations utilizing these tools to manage spacecraft communications are at risk if their interfaces are reachable via the network. Because this flaw carries a CVSS score of 9.8, it represents a critical security gap that could allow unauthorized actors to interfere with sensitive telemetry and command operations.

How the Flaw Works

Missing authentication vulnerabilities occur when a system fails to verify the identity of a user or process before granting access to protected functionality. In a general sense, this class of weakness allows an attacker to interact directly with internal API endpoints as if they were an authorized user. When these endpoints control sensitive operational functions, an attacker can perform unauthorized actions, such as modifying system state, retrieving private data, or injecting malicious input into backend processes without needing to bypass login screens or session management controls.

How to Protect Your Systems

• Upgrade your AIT-DSN installation to version 2.2.2 or later immediately to apply the vendor-provided patch.
• Restrict network access to the AIT-DSN interface by placing it behind a firewall or within a secure, segmented management network.
• Implement strict access control lists (ACLs) to ensure only authorized internal systems can communicate with the SLE interface.
• Monitor network traffic and system logs for unauthorized HTTP requests directed at API endpoints, which may indicate attempted exploitation.
• Follow vendor hardening documentation to ensure that all default configurations are reviewed and secured against unauthorized access.

Given the high severity of this vulnerability and the nature of the affected systems, prompt action is necessary to mitigate the risk of unauthorized session manipulation. Applying the version 2.2.2 patch is the primary defense against this flaw, as it restores the required authentication checks that prevent unauthenticated network actors from hijacking spacecraft communication links.