NASA's Mission Console Slipped Out With Zero Auth, Letting Anyone Command Spacecraft
NASA/JPL's open-source AIT-GUI console listens on every network interface with no password, so anyone reaching port 8080 can POST arbitrary spacecraft commands, run scripts, and traverse files. The 9.4-CVSS chain (GHSA-p9r8-2q67-fp86) hits versions through 2.5.1, and because browsers treat these requests as CORS-simple, a cross-origin POST can drive the bus even in firewalled setups. Fixed in 2.5.2, which binds the listener to localhost and rejects cross-origin calls.