The vulnerability is exploitable when ait-server is running and an attacker can reach the ZeroMQ XSUB or XPUB interfaces on TCP ports 5559 or 5560. The shipped default configuration binds these interfaces to all network interfaces.
"}],"value":"The vulnerability is exploitable when ait-server is running and an attacker can reach the ZeroMQ XSUB or XPUB interfaces on TCP ports 5559 or 5560. The shipped default configuration binds these interfaces to all network interfaces."}],"credits":[{"lang":"en","type":"finder","value":"Shukrulloh Raximov (Mothra)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.
"}],"value":"CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback."}],"impacts":[{"descriptions":[{"lang":"en","value":"With the shipped default configuration, the ZeroMQ command and telemetry bus is unauthenticated and network-reachable because ait-server binds to all network interfaces. An unauthenticated attacker who can reach TCP ports 5559 or 5560 can inject arbitrary data onto the spacecraft command-uplink path, read real-time telemetry and command traffic from the ground bus, inject forged telemetry into operator displays, limit checks, and the historian, or disrupt command-bus availability. Exploitation requires no plugin, credentials, or user interaction; ait-server only needs to be running and the affected ZeroMQ ports must be reachable. Successful exploitation compromises the confidentiality, integrity, and availability of the spacecraft command and telemetry path."}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-03T11:55:44.853Z","orgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","shortName":"TuranSec"},"references":[{"url":"https://github.com/NASA-AMMOS/AIT-Core/security/advisories/GHSA-ccw5-g774-3683"},{"url":"https://github.com/NASA-AMMOS/AIT-Core/"},{"url":"https://github.com/advisories/GHSA-3j6g-pxmx-58qg"},{"url":"https://github.com/Mothra-1"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to AIT-Core 3.1.2 or later. Version 3.1.2 changes the default ZeroMQ XSUB and XPUB bind addresses to loopback. Deployments that require the ZeroMQ message bus to operate across multiple hosts should protect the bus using authenticated and encrypted transport such as ZeroMQ CURVE or an equivalent mutually authenticated TLS-protected network layer.
"}],"value":"Upgrade to AIT-Core 3.1.2 or later. Version 3.1.2 changes the default ZeroMQ XSUB and XPUB bind addresses to loopback. Deployments that require the ZeroMQ message bus to operate across multiple hosts should protect the bus using authenticated and encrypted transport such as ZeroMQ CURVE or an equivalent mutually authenticated TLS-protected network layer."}],"source":{"discovery":"EXTERNAL"},"title":"Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","assignerShortName":"TuranSec","cveId":"CVE-2026-105105","datePublished":"2026-10-03T11:55:44.853Z","dateReserved":"2026-10-03T11:45:52.353Z","dateUpdated":"2026-10-03T15:52:53.747Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-03 12:16:57","lastModifiedDate":"2026-10-03 16:16:35","problem_types":["CWE-306","CWE-306 CWE-306: Missing Authentication for Critical Function"],"metrics":{"cvssMetricV31":[{"source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-03T15:46:54.964389Z","id":"CVE-2026-105105","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"105105","Ordinal":"1","Title":"Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows ","CVE":"CVE-2026-105105","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"105105","Ordinal":"1","NoteData":"CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.","Type":"Description","Title":"Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows "}]}}}