The vulnerability is a missing authentication failure in the ait.core.server telemetry and command broker. The broker binds its ZeroMQ XSUB and XPUB sockets to all network interfaces without authentication or transport security, allowing an unauthenticated network attacker to publish on internal topics and to subscribe to all command and telemetry traffic. This enables an attacker to inject spacecraft command data, forge telemetry, exfiltrate existing telemetry, or disrupt the command and telemetry bus. The weakness is a CWE-306 flaw.

NASA-AMMOS AIT-Core versions up to 3.1.1 are affected; the 3.1.2 release changes the default ZeroMQ bind addresses to loopback, mitigating the issue. Deployments that need the message bus to operate across multiple hosts must protect the bus with authenticated and encrypted transport such as ZeroMQ CURVE or a mutually authenticated TLS‑protected network layer.

The CVSS base score is 9.8, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but remote exploitation is straightforward for an attacker with network access to the ZeroMQ bus. An attacker who can reach TCP port 5559 can publish commands to the __commands__ topic, which are then forwarded to the command‑uplink UDP path, while an attacker on port 5560 can subscribe to all telemetry and command traffic. The lack of authentication makes the exploitation trivial once network connectivity is achieved.