Cyber Blog

Security researchers have discovered serious weaknesses in software used to help operators communicate with spacecraft and scientific instruments. The vulnerabilities affect AIT-GUI, a web-based control interface associated with NASA and the Jet Propulsion Laboratory’s open-source AMMOS Instrument Toolkit. Researchers warn that, under certain circumstances, an attacker who does not have a username or password could potentially send unauthorized commands through the software.

The problem is particularly concerning because AIT-GUI is designed to act as a control panel for systems that communicate with spacecraft and instruments. Instead of simply displaying information, the software can send instructions to those systems. Researchers from Cycode found that several security weaknesses could be combined to allow someone with network access to the software to issue commands, run scripts on the computer hosting the software, and execute sequences of actions without first proving that they were an authorized user.

The vulnerability was given a severity rating of 9.4 out of 10, placing it in the critical category. The issues affect versions 2.5.1 and earlier according to Cycode’s advisory, while version 2.5.2 was released with security improvements. The researchers reported their findings on August 13, 2026. A separate security report has also identified a related authentication problem in earlier versions of the software, showing that concerns about unauthorized access to AIT-GUI have been raised by multiple researchers.

One of the biggest problems is that the software’s web server could accept important requests without asking who was making them. In simple terms, the control panel was not consistently checking whether someone sending a command was actually an authorized operator. That creates a serious risk because an attacker who could reach the system might be able to interact with functions that were intended only for trusted personnel.

Researchers identified several functions that could be abused. One could potentially be used to send commands to spacecraft or instruments. Another could allow an attacker to run scripts on the computer hosting the software. A third could be used to run predefined sequences of actions. These capabilities are significantly more serious than a typical website vulnerability because the software is connected to systems designed to control equipment.

The researchers also discovered that some of the software’s settings could cause it to listen for connections on every available network connection rather than only on a specific, trusted connection. This could make the software easier to reach than its operators might expect, depending on how the surrounding network was configured.

Another problem involved something called a cross-site request forgery attack. The technical term sounds complicated, but the basic idea is relatively simple. An attacker could potentially create a malicious website that secretly sends a request to the vulnerable software when someone with access to the system visits that website. Because browsers can automatically send certain types of requests, the victim might not realize that their visit to an unrelated webpage had triggered an action on another system.

Researchers said this was particularly important because the attack could potentially work even when the AIT-GUI system was protected by a firewall or restricted to a local network. If an authorized operator could access the control panel through their browser and then visited a malicious webpage, that webpage could potentially attempt to send requests to the internal system.

The vulnerabilities involving files created another layer of risk. Some of the software’s functions accepted information that was later used to determine which files should be accessed or executed. Researchers found that this information was not always properly restricted. In practical terms, an attacker could potentially attempt to make the software access files outside of the locations where it was supposed to operate.

NASA’s AMMOS Instrument Toolkit is intended to provide software components for ground systems that communicate with spacecraft and process information received from them. AIT-GUI provides a graphical interface that makes it easier for operators to interact with those systems. Because of that role, security problems in the interface can have consequences beyond the computer running the web application.

The developers released AIT-GUI version 2.5.2 on August 12, 2026, with several changes designed to reduce the risk. The newer version limits where the web server listens for connections, adds checks designed to prevent unauthorized requests from other websites, and places stricter limits on which files can be accessed by certain functions.

However, security researchers have pointed out that the update does not appear to add traditional username-and-password authentication to all of the affected command functions. The Hacker News also reviewed the source code and reported that some of the authentication concerns identified by researchers may still exist in the newer release. This means organizations using the software should carefully review the security advisories and the specific version they have installed rather than assuming that every security concern has been eliminated simply by updating.

There is currently no indication from the reports that these vulnerabilities have been used in an attack against an actual NASA mission or spacecraft. The researchers did not identify a specific mission that was running the vulnerable software, and there is no reported evidence of exploitation. Even so, the potential impact is significant because the software is designed to help control spacecraft and scientific equipment.

The discovery is also a reminder that software used in space and other critical systems needs the same kind of security protections as ordinary internet-connected applications. A vulnerability does not have to be directly connected to a spacecraft to become a serious concern. If an attacker can first gain access to the computer or network running a control system, weaknesses in that software could potentially provide a path toward more sensitive systems.

For organizations using AIT-GUI, the safest approach is to upgrade to the latest available version, review the vendor’s security guidance, and restrict access to the application as much as possible. Systems that control important equipment should not be exposed unnecessarily, and network access should be limited to trusted users and machines. Operators should also be cautious about visiting unfamiliar websites from computers that have access to sensitive control systems.

The incident highlights a broader cybersecurity lesson: software that looks like a simple web dashboard can sometimes have the ability to control extremely important systems behind the scenes. In this case, researchers found that weaknesses in a web-based interface could potentially give an unauthorized person much more power than they might expect. Keeping these systems updated, limiting who can reach them, and adding strong access controls are essential steps for reducing that risk.