IT SBIT Services
Schneeberger
DEEN
CVE tracker

NASA-AMMOS AIT-Core: Missing authentication in ZeroMQ command and telemetry broker

CVE-2026-105105Critical 9.8Public exploit

← All vulnerabilities

Summary

AIT-Core through 3.1.1 ships an ait-server ZeroMQ broker that binds its XSUB and XPUB sockets to all network interfaces without authentication or transport security. A remote attacker with network access to TCP ports 5559 and 5560 can inject spacecraft command messages, subscribe to command and telemetry traffic, inject forged telemetry, or disrupt the bus. The CNA rates this CVE 9.8 (CRITICAL), but NVD analysis is still pending.

Affected

  • NASA-AMMOS AIT-Core 0 to 3.1.1 (default configuration)
  • Exploitable when ait-server is running and TCP ports 5559 or 5560 are reachable from the network

Fixed in

  • AIT-Core 3.1.2 or later (default ZeroMQ bind addresses changed to loopback)

Workaround

  • Block TCP ports 5559 and 5560 at host and network firewalls
  • Isolate the ait-server host in a segmented VLAN
  • Use SSH port forwarding for remote access
  • Protect multi-host ZeroMQ deployments with ZeroMQ CURVE or mutually authenticated TLS (vendor-related guidance, not fully confirmed)

Exploitation

  • Not known to be exploited in the wild; not listed in CISA KEV according to secondary trackers
  • CISA SSVC: exploitation none, automatable yes, technical impact total
  • A public PoC repository is reported by Sploitus, but this is not verified; trackers disagree

Our recommendation

  • Check whether AIT-Core is deployed anywhere, including lab, CubeSat or research setups, and whether it is version 3.1.1 or earlier
  • Upgrade to AIT-Core 3.1.2 or later
  • Until patched, block ports 5559 and 5560 and keep the broker off untrusted networks
  • Review logs for unexpected connections to the ZeroMQ ports and for unexpected command traffic
  • Verify the vendor advisory and NVD entry for later changes

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:21.

Original description (NVD)

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed