AMMOS AIT DSN Interface Missing Authentication (SLE API Exposure)

Technical Analysis

CVE-2026-60113 (CVSS 9.8) stems from an SLE interface manager that fails to enforce authentication on seven API routes, allowing any network-reachable attacker to issue direct HTTP requests without credentials. Exploitation enables session control (start/stop) over Deep Space Network communication links, retrieval of telemetry frame data, and injection of arbitrary frames into live spacecraft downlink/uplink streams, which could corrupt command sequences or spoof telemetry. This is a classic broken access control / missing authentication flaw (CWE-306) rather than a memory corruption issue, meaning exploitation requires no specialized payload—just knowledge of the exposed endpoints and network reachability. Given the operational context (mission-critical space communications), successful exploitation could disrupt spacecraft operations, corrupt scientific data integrity, or enable unauthorized command injection with potentially irreversible consequences. This vulnerability is confined to specialized aerospace ground-system software and has no direct plausible impact on commercial AI agent, LLM tool-use, or RAG pipeline infrastructure.

Affected Systems

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface, all versions prior to 2.2.2; specifically the Space Link Extension (SLE) interface manager component and its seven exposed API routes

Indicators of Compromise

• No specific hashes, IPs, or domains published; indicators would include anomalous unauthenticated HTTP requests to SLE interface manager API endpoints, unexpected DSN session start/stop commands, and unauthorized telemetry frame injection events in AIT DSN interface logs

Remediation Steps

1. 1

   Upgrade to Patched Version

   Update AMMOS Instrument Toolkit (AIT) DSN Interface to version 2.2.2 or later, which addresses the missing authentication vulnerability in the SLE interface manager.

2. 2

   Restrict Network Access

   Implement network segmentation and firewall rules to limit access to SLE interface manager API routes to only trusted, authorized systems and personnel networks.

3. 3

   Enforce Authentication Controls

   Deploy compensating authentication mechanisms (mutual TLS, API gateway with credential enforcement, VPN access) in front of the SLE interface until the patched version is fully deployed.

4. 4

   Audit and Monitor API Access

   Review logs for unauthenticated requests to the seven identified API routes and establish continuous monitoring/alerting for anomalous session control or frame injection activity.

5. 5

   Validate Telemetry Integrity

   Cross-check telemetry data streams against independent sources to detect potential frame injection or tampering resulting from prior exploitation.