Yamcs includes an LDAP authentication module that builds LDAP search filters by directly inserting a user supplied username without RFC 4515 escaping. This omission allows an attacker to inject LDAP control characters into the filter string, potentially altering the query to return unexpected results or bypass authentication. The vulnerability is categorized as CWE‑90. While the issue does not grant immediate remote code execution, it can lead to unauthorized access or disclosure of directory contents, thereby compromising confidentiality and integrity of the mission control environment.

The vulnerability exists in any Yamcs installation using a version older than 5.12.7 or 5.13.0. All releases prior to those patched releases are affected. The affected product is the Yamcs mission control framework from the vendor Yamcs.

The CVSS score of 4.3 reflects the moderate risk of this flaw; it does not enable remote code execution but can be leveraged by an attacker who can influence the authentication request. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves network or local access to the authentication service where a crafted username can be supplied to the LDAP query. Exploitation requires the ability to send authentication requests to the affected module.