A critical authentication bypass in NASA-AMMOS ANMS exposes the REST API to the network, enabling unauthenticated attackers to execute arbitrary commands and disrupt network management operations.

The system incorrectly publishes the REST API on the host network without requiring authentication, and the underlying CivetWeb server is configured with a null authentication callback for command-dispatch endpoints.

An attacker can enumerate managed network agents and submit arbitrary command sets, which could lead to unauthorized control over simulated or real ground nodes. This represents a significant risk to the integrity of the network management testbed and associated ground operations.

Immediate Action: Update the software to the latest version and ensure the REST API is not exposed to public network interfaces.

Proactive Monitoring: Audit network configurations for any services bound to public interfaces that should be restricted to local or trusted segments.

Compensating Controls: Deploy a firewall or reverse proxy with mandatory authentication to gate access to the REST API endpoints.

Public Exploit Available: No

While this software is described as a reference implementation, it is vital to secure any instances deployed in operational or testing environments. Administrators must restrict network access and verify that authentication mechanisms are correctly enabled.