NASA spacecraft GUI flaw lets attackers run arbitrary commands

A critical vulnerability has been discovered in the NASA/JPL AIT-GUI, allowing unauthenticated command execution on spacecraft instruments. The flaw, with a CVSS score of 9.4, enables anyone to send arbitrary commands, run server-side scripts, and execute command sequences without authentication or protection against CSRF attacks. The root causes include misconfigured host settings, lack of authentication and session checks, and inadequate path confinement for command inputs. NASA/JPL has released a fix in version 2.5.2, and operators are advised to upgrade and secure the system against untrusted network access.