The vulnerability identified as CVE-2026-105105 (CWE-306) affects the ait.core.server telemetry and command broker (ait-server) component of NASA-AMMOS AIT-Core through version 3.1.1. The ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default and does not implement authentication or transport security. This allows an unauthenticated remote attacker with network access to TCP ports 5559 and 5560 to publish unauthorized command messages, subscribe to command and telemetry traffic, inject forged telemetry data, exfiltrate sensitive command and telemetry information, or disrupt the command and telemetry bus. The default configuration forwards command messages through command_stream and emits them on the command-uplink UDP path. The vulnerability is mitigated in version 3.1.2 by changing the default ZeroMQ bind addresses to loopback, preventing remote network access.

An unauthenticated remote attacker with network access to the ZeroMQ message bus can perform critical unauthorized actions including injecting spacecraft command data, exfiltrating command and telemetry traffic, injecting forged telemetry, and disrupting the command and telemetry bus. This compromises confidentiality, integrity, and availability of spacecraft command and telemetry communications, posing a severe risk to mission operations.

A fix is available in NASA-AMMOS AIT-Core version 3.1.2, which changes the default ZeroMQ bind addresses to loopback only, effectively preventing remote network access to the message bus. Users should upgrade to version 3.1.2 or later to remediate this vulnerability. No other mitigation guidance is provided in the vendor advisory.