漏洞概述 漏洞名称: AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes 严重程度: CRITICAL 发布日期: 7/29/2026 CVE编号: CVE-2026-60113 CWE编号: CWE-306 Missing Authentication for Critical Function CVSS评分: 9.3 CVSS V4向量: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 影响范围 受影响版本: AIT-DSN < 2.2.2 描述: AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links. 修复方案 参考链接: - Release Notes - Changelog - GitHub Security Advisory - Patch Commit 其他信息 贡献者: Saidakbarxon Maxsudxonov 总结 该漏洞涉及AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface在2.2.2版本之前的缺失认证问题。攻击者可以通过发送无凭证的直接HTTP请求来访问七个未受保护的API路由，从而控制深空网络通信会话、检索遥测帧数据以及向活跃的航天器链路注入任意帧。建议尽快升级到修复后的版本以解决此问题。