CVE-2026-85433 in essential-moos
Summary
by MITRE • 09/04/2026
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in MOOS essential-moos versions through 10.0.1 represents a critical failure in access control mechanisms within the Middleware for Observation, Orientation and Supervision framework. This open-source software suite is widely utilized in autonomous underwater vehicles, unmanned surface vessels, and other robotics applications to manage communication between distributed nodes via an asynchronous publish-subscribe architecture. The core issue lies in the improper authorization of PSHARE_CMD messages, which are intended for network configuration tasks such as defining how data flows through the system. Because the software fails to validate the identity or permissions of the entity sending these commands, any node on the local network that can reach the MOOS infrastructure is granted unrestricted ability to modify critical routing parameters. This lack of authentication and authorization creates a severe security gap where malicious actors do not need valid credentials to interact with sensitive system configurations.
From a technical perspective, the flaw allows an attacker to inject crafted PSHARE_CMD messages containing specific command parameters such as cmd=output or cmd=input. These commands are designed to establish new listeners on arbitrary network addresses or redirect existing bus traffic. In a normal operational context, this functionality is useful for dynamic reconfiguration of sensor data streams during development or maintenance. However, in the hands of an attacker, it becomes a powerful tool for intercepting sensitive telemetry and control signals. By specifying arbitrary destination addresses, the attacker can configure the MOOS infrastructure to duplicate or redirect outgoing traffic from critical components like navigation systems, sonar arrays, or command interfaces to servers under their control. This effectively turns the legitimate communication backbone of the autonomous system into a conduit for data exfiltration without triggering standard security alerts because the actions are performed using valid protocol commands that bypass permission checks.
The operational impact of this vulnerability is profound and potentially catastrophic depending on the deployment environment. In maritime or aerial robotics applications, where MOOS is frequently deployed, the ability to redirect bus traffic means an attacker can perform a man-in-the-middle attack at the application layer. They can silently monitor all communications between sensors and control systems, gaining visibility into the vehicle's position, status, and operational intent. Furthermore, by manipulating listeners and routes, an attacker could potentially disrupt normal operations by flooding channels with noise or dropping critical packets, leading to system instability or loss of control. The ability to open new listeners on arbitrary addresses also expands the attack surface significantly, allowing for persistent backdoors that remain active even if other security measures are tightened around specific nodes. This level of access undermines the integrity and confidentiality guarantees essential for safe autonomous operation in hostile environments.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials or Default Configuration, as it stems from a default state where network configuration commands are accessible to all peers without restriction. In terms of the MITRE ATT&CK framework for ICS and IoT, this behavior maps directly to T1046 Network Service Discovery combined with T1572 Protocol Tunneling if used to exfiltrate data over non-standard channels, or more accurately to T1078 Valid Accounts if the attacker compromises a node first, but primarily it reflects T1190 Exploit Public-Facing Application and T1048 Exfiltration Over Alternative Protocol. The lack of mutual authentication between nodes is a common architectural weakness in legacy robotics middleware that prioritizes ease of development over security by default.
Mitigation strategies must address both the immediate configuration flaws and long-term architectural improvements. For systems currently running vulnerable versions, administrators should implement network-level segmentation to isolate MOOS infrastructure from untrusted networks or devices. Firewalls can be configured to restrict PSHARE_CMD traffic to only known, trusted IP addresses associated with authorized control stations. Additionally, enabling strict firewall rules that limit inbound connections on the ports used by MOOS listeners can prevent attackers from establishing new listening endpoints on arbitrary addresses. It is also advisable to disable unnecessary network configuration commands in production environments if dynamic reconfiguration is not required during operation.
Long-term remediation requires upgrading to a version of essential-moos where this authorization flaw has been patched, ensuring that PSHARE_CMD messages are validated against an access control list or require cryptographic authentication before execution. Developers should implement mutual TLS or similar secure communication protocols for all inter-node messaging within the MOOS framework. This ensures that only authenticated peers can send configuration changes and data traffic is encrypted in transit. Furthermore, adopting a zero-trust architecture where every node must verify the identity of its counterparts before accepting commands will prevent unauthorized reconfiguration attempts. Regular security audits focusing on middleware configurations and continuous monitoring for anomalous network routing changes are essential to detect any exploitation attempts that may bypass initial defenses.