CVE-2026-85430 in essential-moos
Summary
by MITRE • 09/04/2026
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in MOOS essential-moos versions through 10.0.1 represents a critical authentication bypass flaw within the pShare component, which serves as a central hub for message routing and sharing among autonomous underwater vehicle communities. The core technical deficiency lies in the failure to validate the source of incoming UDP datagrams or verify their authenticity before processing. Specifically, the pShare module accepts network packets from any IP address without implementing cryptographic verification or strict access control lists. This architectural oversight allows external actors to interact directly with the internal messaging infrastructure, bypassing intended security boundaries that should restrict communication to trusted peers within a defined community.
From an operational perspective, this flaw enables two distinct categories of malicious activity: identity spoofing and denial of service. An attacker can craft specific UDP datagrams containing false metadata regarding their origin or affiliation. When these packets are received by pShare, the system republishes them into the local MOOS community while preserving the fabricated sender information. This capability allows an adversary to inject arbitrary messages that appear to originate from legitimate nodes within the network. Such spoofing can lead to severe integrity violations, where autonomous systems make decisions based on false telemetry or command data, potentially resulting in mission failure, collision risks, or unauthorized control of vehicle assets.
Furthermore, the lack of robust input validation extends beyond identity manipulation to include structural integrity checks for packet payloads. The pShare process is susceptible to crashes when it receives malformed UDP datagrams that exceed expected buffer sizes or contain invalid formatting structures. This instability constitutes a denial-of-service vector, as an attacker can repeatedly send these crafted packets to exhaust system resources or trigger unhandled exceptions within the C++ codebase of MOOS. A crash in pShare effectively severs communication for all nodes relying on it, disrupting coordination and potentially leaving autonomous vehicles without critical navigation or status updates during sensitive operations.
In terms of industry classification standards, this vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to adequately verify the identity of entities attempting to access resources. Additionally, the ability to inject messages under a false identity maps directly to MITRE ATT&CK technique T1098, specifically Account Manipulation or SSH Hijacking variants depending on the specific implementation context, though in this distributed systems context it is best characterized as Identity Spoofing within a messaging bus architecture. The denial-of-service aspect corresponds to CWE-400, Uncontrolled Resource Consumption, and MITRE ATT&CK technique T1499, Endpoint Denial of Service.
Mitigation strategies must prioritize the implementation of strict network-level access controls and application-layer authentication mechanisms. Network administrators should configure firewalls or intrusion prevention systems to restrict UDP traffic on pShare ports exclusively to known, trusted IP addresses within the operational subnet. Within the MOOS configuration itself, developers should enforce cryptographic signing of messages so that recipients can verify the integrity and origin of each datagram before processing it. Additionally, implementing rigorous input validation routines in the pShare module is essential to detect and discard malformed packets without crashing the process, thereby ensuring high availability even under adversarial conditions.