AIT-GUI unauthenticated command execution security flaw
Vulnerability
Summary
Hide ▲
Show ▼
AIT-GUI has a critical unauthenticated command-execution vulnerability affecting versions through 2.5.1, with a fix in 2.5.2. Attackers could reach /cmd, /script/run, and /seq through browser-compatible requests because the state-changing endpoints lacked authentication, authorization, and CSRF protection. The flaw exposes spacecraft and instrument command infrastructure to unauthorized use from the browser path.
Timeline
-
18.08.2026 17:30 2 articles · 2h ago
Cycode discloses critical AIT-GUI command-execution flaw
Initial DisclosureCycode researcher Yuval Elbar disclosed a critical vulnerability in NASA's open-source AMMOS Instrument Toolkit (AIT)-GUI ground software that affects versions through 2.5.1 and was fixed in AIT-GUI 2.5.2. The flaw lets unauthenticated attackers issue spacecraft and instrument commands, execute server-side scripts, and run command sequences through exposed state-changing routes, with the web server starting on all network interfaces and lacking authentication, authorization, and CSRF protection.
Show sources
- NASA Ground Control Software Flaw Enables Unauthenticated Commands — www.infosecurity-magazine.com — 18.08.2026 17:30
- NASA Ground Control Software Flaw Enables Unauthenticated Commands — www.infosecurity-magazine.com — 18.08.2026 17:30