CVE-2026-105105: CWE-306: Missing Authentication for Critical Function in NASA-AMMOS AIT-Core

This vulnerability (CWE-306) in the ait-server component of NASA-AMMOS AIT-Core (versions up to 3.1.1) stems from missing authentication on critical functions of the ZeroMQ message broker. The broker binds XSUB and XPUB sockets to all network interfaces without authentication or encryption, exposing TCP ports 5559 and 5560. An attacker with network access to these ports can inject commands, exfiltrate telemetry and command data, inject forged telemetry, or disrupt command and telemetry operations. The default configuration forwards command messages through command_stream and emits them on the command-uplink UDP path, increasing exposure. The issue is addressed in version 3.1.2 by restricting ZeroMQ bindings to the loopback interface, preventing remote network access.

An unauthenticated remote attacker with network access to the ZeroMQ message bus can perform high-impact actions including injecting spacecraft command data, exfiltrating sensitive command and telemetry traffic, injecting forged telemetry data, and disrupting the command and telemetry bus. This compromises confidentiality, integrity, and availability of critical spacecraft command and telemetry functions.

A fix is available in NASA-AMMOS AIT-Core version 3.1.2, which changes the default ZeroMQ bind addresses to the loopback interface, effectively preventing remote network access to the message bus. Users should upgrade to version 3.1.2 or later to mitigate this vulnerability. No other official patches or workarounds are documented. Until upgraded, restricting network access to TCP ports 5559 and 5560 is recommended to reduce exposure.