The vulnerability identified as CWE-306 (Missing Authentication for Critical Function) affects the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core versions up to 3.1.1. The ZeroMQ broker binds XSUB and XPUB sockets to all network interfaces by default without authentication or encryption. This allows an unauthenticated attacker with network access to TCP port 5559 to publish messages on internal topics, including the critical __commands__ topic, potentially injecting spacecraft commands. Additionally, access to TCP port 5560 allows subscription to command and telemetry traffic, enabling data exfiltration or injection of forged telemetry. The default configuration forwards command messages through command_stream and emits them on the command-uplink UDP path. The issue is addressed in AIT-Core 3.1.2 by restricting ZeroMQ bind addresses to loopback, preventing remote network access.

An unauthenticated remote attacker with network access to the ZeroMQ message bus can inject unauthorized spacecraft commands, exfiltrate sensitive command and telemetry data, inject forged telemetry data, or disrupt the command and telemetry communication bus. This can lead to full compromise of spacecraft command and telemetry operations, representing a critical impact on confidentiality, integrity, and availability.

A fix is available in AIT-Core version 3.1.2, which changes the default ZeroMQ bind addresses to loopback, effectively preventing remote network access to the message bus. Users should upgrade to version 3.1.2 or later to mitigate this vulnerability. No other mitigations are indicated in the advisory.