Skip to content Skip to footer

OpenC3 Cosmos 6.0.0: A Security Assessment of an Open-Source Mission Framework

Written by: Andrzej Olchawa, Ricardo Fradique, Milenko Starcik OpenC3 Cosmos is an open-source command and control software suite designed to support space mission operations. Despite its modularity and widespread adoption across the industry, a recent security assessment of version 6.0.0 uncovered several critical vulnerabilities that could compromise mission-critical systems' confidentiality, integrity, and availability. …

Read More

NASA cFS version Aquila Software Vulnerability Assessment

Written by: Milenko Starcik, Andrzej Olchawa, Ricardo Fradique, Ayman Boulaich NASA's Core Flight System (cFS) is an open-source software framework that supports mission operations by providing a modular and scalable architecture. Despite its widespread use in aerospace applications, a recent security assessment of cFS version Aquila uncovered critical vulnerabilities that could be exploited to disrupt…

Read More

Remote Code Execution and Critical Vulnerabilities in NASA fprime v3.4.3

Written by: Milenko Starcik, Andrzej Olchawa, Ricardo Fradique, Ayman Boulaich NASA's fprime (F') is an open-source software framework for developing and deploying embedded systems, particularly for spaceflight missions. Maintained and developed by NASA's Jet Propulsion Laboratory (JPL), it allows for modular system development by defining the exact interactions of components using a standard interface. But…

Read More

More XSS and Clickjacking in Yamcs v5.8.6

Written by: Andy Olchawa , Milenko Starcik Yet Another Mission Control System (Yamcs v5.8.6) is an open-source software framework for the command and control of spacecraft, satellites, payloads, ground stations and ground equipment developed by Space Applications Services. Given that the software provides a wide range of monitoring and control capabilities and is used/supported by…

Read More

IDOR’s in NCIA ANET v3.4.1

Written by: Andy Olchawa, Milenko Starcik Background The Advisor Network ("ANET") is a platform designed to monitor the connections between advisors and their advisees. It was initially developed by the Defense Digital Service to aid the USFOR-A and Resolute Support missions in supporting the Afghan government by providing a structure for training, advising, and assisting.…

Read More

Remote Code Execution via Man-in-the-Middle (and more) in NASA’s AIT-Core v2.5.2

Written by: Andy Olchawa, Milenko Starcik The NASA - National Aeronautics and Space Administration AMMOS Instrument Toolkit (AIT) is a versatile, Python-based software suite designed to handle a wide range of tasks associated with Ground Data Systems (GDS), Electronic Ground Support Equipment (EGSE), commanding, telemetry uplink/downlink, and sequencing for both instrument and CubeSat missions. Building…

Read More