The AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface versions prior to 2.2.2 contain a missing authentication vulnerability in the Space Link Extension (SLE) interface manager. This vulnerability permits unauthenticated remote attackers to access seven unprotected API endpoints by sending direct HTTP requests without any credentials. Exploitation enables attackers to control DSN communication sessions, access telemetry data, and inject arbitrary frames into spacecraft communication links, potentially disrupting or manipulating spacecraft operations. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting high impact and ease of exploitation. No official remediation or patch information is currently provided.

Unauthenticated attackers can remotely access critical API endpoints of the AIT-DSN interface, allowing them to start or stop communication sessions with the Deep Space Network, retrieve sensitive telemetry frame data, and inject arbitrary frames into active spacecraft links. This could lead to disruption or manipulation of spacecraft communications and telemetry data integrity, posing a significant risk to mission operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected AIT-DSN interface to trusted entities only and monitor for unauthorized access attempts. Implement network-level controls such as firewalls or VPNs to limit exposure of the vulnerable API endpoints.