A significant security vulnerability in NASA’s AIT-GUI, used for controlling spacecraft and scientific instruments, has been identified. This flaw allows unauthorized individuals to issue commands without any need for authentication.
Security Flaw Details
Discovered by Yuval Elbar of Cycode, the flaw is rated at 9.4 on the CVSS v3.1 scale. It was addressed in version 2.5.2 of the AIT-GUI, released on August 12, 2026. This software is crucial as it functions as the interface for sending commands to spacecraft and processing telemetry data.
The root of the issue lies in the AIT-GUI web server’s configuration. It defaults to listening on all network interfaces, which exposes it to wider network access than intended. Furthermore, critical endpoints lack authentication and authorization measures, allowing potential attackers to execute commands without restrictions.
Associated Vulnerabilities
The problem is exacerbated by related vulnerabilities, such as CVE-2026-60112. This issue permits attackers to obtain a valid session without credentials, thereby executing arbitrary commands. This vulnerability, rated at 9.8, was disclosed prior to the main advisory.
Given the nature of the flaw, even systems protected from direct internet exposure are at risk if operators access malicious web pages. Browsers can send commands to the console without user interaction, making the vulnerability particularly dangerous.
Preventive Measures and Recommendations
NASA has released a patch with AIT-GUI version 2.5.2 and strongly advises users to upgrade immediately. It’s crucial to ensure that the console port is not accessible from untrusted networks. Additionally, reviewing command logs for anomalies is recommended to detect any prior unauthorized access.
For organizations maintaining these systems, enhancing security involves implementing authentication and authorization checks, securing the server configuration, and validating script paths to prevent unauthorized access. These measures are essential to protect against the operational risks posed by such vulnerabilities.
This incident highlights the importance of robust security practices in ground systems, emphasizing that these platforms are not immune to common web application vulnerabilities. Ensuring that these systems are secure is critical to prevent potential real-world consequences.
