CVE-2026-85424 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The MOOS core-moos software suite, specifically through version 10.4.0, contains a critical authentication deficiency within its wire communication protocol that fundamentally compromises the integrity of autonomous systems relying on this middleware for coordination. The architecture was designed with an assumption of trust among connected nodes, leading to the omission of mandatory identity verification mechanisms during the initial handshake phase. This design flaw allows any network client capable of reaching the MOOS infrastructure to establish a connection without providing valid credentials or proving its authorized status. In environments where MOOS is deployed for unmanned surface vehicles, underwater drones, or other autonomous platforms, this lack of access control creates a severe attack vector that can lead to complete system compromise and operational disruption.
The technical nature of this vulnerability centers on the failure to enforce strict identity validation against a predefined list of authorized clients. While the software includes compile-time checks for protocol strings intended to ensure compatibility between components, these safeguards are insufficient as they do not prevent unauthorized entities from spoofing valid client identifiers or simply connecting with arbitrary names that bypass existing filters. An attacker exploiting this flaw can inject themselves into the communication bus as a legitimate node, thereby gaining unrestricted access to all published topics and subscribed data streams. This capability effectively neutralizes any perimeter security measures since the vulnerability operates at the application layer protocol level rather than relying on network-level isolation alone.
The operational impact of this authentication bypass is profound due to the elevated privileges granted upon connection. Once an unauthenticated client establishes a session, it inherits full publish and subscribe rights across all active processes within the MOOS infrastructure. More critically, the attacker gains access to administrative commands such as DB_CLEAR, which serves to reset all internal variables and clear client mail queues. This action effectively wipes the state of the autonomous system, causing immediate loss of situational awareness for navigation algorithms and control systems. For mobile platforms dependent on continuous data streams from sensors or other coordinating nodes, this sudden cessation of information flow can result in erratic behavior, mission failure, or physical damage to hardware due to uncontrolled movement or collision risks.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. The ability to execute privileged operations like database clearing without verification maps directly to ATT&CK technique T1548 Abuse Configuration, where an adversary exploits misconfigured permissions or missing access controls to gain higher-level privileges. Additionally, the potential to disrupt service by clearing critical data queues relates to availability impacts described in CWE-762 Missing Release of Resource after Effective Lifetime and can be leveraged for denial-of-service scenarios within autonomous networks.
Mitigation strategies must prioritize immediate implementation of robust authentication mechanisms at the protocol level. Developers should integrate mutual TLS or similar cryptographic handshake protocols that verify both server and client identities before allowing any data exchange. Furthermore, input validation on client names and connection requests is essential to prevent spoofing attacks even if basic connectivity checks are bypassed. Organizations deploying MOOS core-moos in production environments should apply available patches as soon as they become available or implement network-level segmentation using firewalls and VLANs to restrict access to the MOOS ports exclusively to known, trusted IP addresses until a software fix is deployed. Regular security audits of middleware configurations will help identify similar trust assumptions that could be exploited by adversaries seeking to disrupt autonomous operations.