The vulnerability arises when the NASA-AMMOS Asynchronous Network Management System’s default Docker compose configuration publishes the amp-manager REST API directly to the host network on port 8089. The CivetWeb server in JHUAPL/dtnma-tools is configured with authentication disabled, and every API route—including command dispatch endpoints—has a null authentication callback. This allows any network‑reachable client to enumerate agents, submit arbitrary EXECSET‑encoded command sets, and clear stored reports without credentials. The result is a full remote command‑execution capability against any DTNMA agent connected to the system, compromising the confidentiality, integrity, and availability of the managed nodes. The weakness falls under CWE‑306, improper authorization.

The affected components are the reference implementation of NASA‑AMMOS ANMS and the JHUAPL‑DTNMA/dtnma‑tools repositories. In the default Docker deployment both are configured to expose the amp‑manager service to the host network on port 8089. No specific product or library versions are listed in the advisory; the issue exists in the reference implementation as shipped. Users running this configuration—whether for simulation, testing, or real DTN networks—are vulnerable.

The CVSS score of 9.8 classifies this as a critical vulnerability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, though the absence of a public exploit does not negate the high severity. Attackers can exploit the exposed REST API from any host that can reach port 8089, bypassing the single authentication boundary that normally protects the system. Because no authentication is required, the attacker can control any registered agent, potentially influencing the operation of ground or spacecraft nodes. The risk is amplified in environments where the amp‑manager service is reachable from the broader network or the Internet, making the exploitation highly probable under those conditions.