Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-105105: AIT-Core lets remote attackers send fake spacecraft commands
CVE-2026-105105 · published 16 days ago
Summary
The AIT-Core software that handles spacecraft command and telemetry traffic can be accessed without any password. If an attacker can reach the system’s network ports, they could inject false commands, read or alter telemetry data, and disrupt communications. Update to version 3.1.2 or later, which restricts access to the local computer, or reconfigure the software to bind only to trusted interfaces and add authentication.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nasa-ammos | ait-core | <= 3.1.1 |
Original advisory text
Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.
References
- https://github.com/NASA-AMMOS/AIT-Core/
- https://github.com/NASA-AMMOS/AIT-Core/security/advisories/GHSA-ccw5-g774-3683
- https://github.com/advisories/GHSA-3j6g-pxmx-58qg Vendor Advisory
- https://github.com/Mothra-1
- https://pypi.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1051... Vendor Advisory
- https://github.com/advisories/GHSA-9xfm-37f4-2h8g
- https://nvd.nist.gov/vuln/detail/CVE-2026-105105 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published3 Oct 2026
Updated15 Oct 2026
First seen3 Oct 2026
Track software like this
Free during beta