CyberRota Analysis
AI-GeneratedThe authentication endpoint in the Yamcs mission control framework prior to version 5.12.7 is vulnerable to brute-force attacks due to the absence of rate limiting and account lockout mechanisms. This allows unauthenticated remote attackers to execute unlimited password-guessing attempts, potentially compromising user accounts. Organizations using affected versions should prioritize upgrading to versions 5.12.7 or 5.13.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)