A critical, now-patched flaw chain in NASA JPL's AIT-GUI console let anyone on the network send commands to a spacecraft or instrument without logging in, rated 9.4 on the CVSS scale and fixed in version 2.5.2.
Read the full story: Flaw in NASA's AIT-GUI Could Let Anyone Command a Spacecraft →
Transcript
A security researcher found a way to send live commands toward a spacecraft without ever typing a password. AIT-GUI is the console NASA JPL engineers use to operate instruments through the AMMOS ground system toolkit, and it had a serious problem. Its web server was listening on every network interface instead of just the one it was configured for, and three of its endpoints, cmd, script run, and seq, accepted commands with zero authentication. No login, no authorization check, nothing. Researcher Yuval Elbar disclosed the chain, it scored 9.4 out of 10 on the severity scale, and NASA-AMMOS patched it fast, shipping version 2.5.2 in the same window. There's no evidence anyone exploited this before the fix went out. But AIT-GUI is open source, so the exposure isn't just JPL's problem, it's every organization running AMMOS-based ground tooling that hasn't updated yet. The lesson here isn't exotic. It's that a boring network misconfiguration plus an API with zero authentication turned into a straight line to hardware that talks to spacecraft.