CVE-2026-85434 in MOOS-IvP
Summary
by MITRE • 09/04/2026
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability in MOOS-IvP versions uFldShoreBroker through 24.8.1 represents a critical authentication failure within the middleware's bridge routing mechanism, specifically affecting how node connectivity is established and maintained. The core technical flaw lies in the absence of cryptographic verification or integrity checks for NODE_BROKER_PING messages before they are processed to create outbound bridge routes. In distributed systems like MOOS-IvP, which relies on a publish-subscribe architecture for autonomous vehicle coordination, trust between nodes is often implicit based on network configuration rather than explicit authentication. This design assumption allows an attacker who gains access to the local network segment or can inject packets into the communication stream to forge these ping messages. By crafting HostRecord data with malicious IP addresses and port numbers, the adversary can trick the broker into establishing a bridge that routes sensitive operational variables away from their intended recipients toward infrastructure controlled by the attacker.
From an operational perspective, this flaw enables severe man-in-the-middle attacks against autonomous systems relying on MOOS-IvP for navigation, sensor fusion, or command execution. Since bridged variables are fundamental to sharing state information such as position, velocity, and environmental data across different nodes, redirecting these streams allows the attacker to intercept, modify, or suppress critical telemetry. This can lead to degraded situational awareness for human operators or autonomous decision-making modules that rely on accurate real-time data. In worst-case scenarios involving unmanned surface vessels or aerial vehicles, manipulating bridge routes could result in incorrect control inputs being sent based on falsified sensor readings, potentially leading to mission failure, collision with obstacles, or loss of the asset entirely. The impact is particularly acute because the vulnerability affects the foundational layer of inter-node communication rather than a specific application-level function, making it difficult to isolate without disrupting overall system connectivity.
This vulnerability aligns closely with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity as defined by common weakness enumerations standards. The failure to validate the source identity or integrity of incoming control messages before acting upon them is a classic example of trusting unverified inputs in security-critical systems. Furthermore, within the context of the MITRE ATT&CK framework for enterprise cybersecurity, this behavior maps directly to T1078 Valid Accounts and potentially T1564 Hidden Processes if the attacker uses the bridge to exfiltrate data without detection. The attack vector leverages the inherent trust placed in network-level communications, exploiting the lack of mutual authentication between broker nodes which is common in legacy or specialized industrial control systems that prioritize low latency over robust security protocols like TLS or IPsec for internal traffic.
Mitigation strategies must focus on implementing strict access controls and cryptographic verification mechanisms within the MOOS-IvP architecture. Immediate remediation involves updating to a patched version of uFldShoreBroker where possible, as later releases likely address this by introducing signature validation for NODE_BROKER_PING messages or requiring pre-shared keys for bridge establishment. In environments where immediate patching is not feasible, network segmentation should be enforced using firewalls and VLANs to restrict which hosts can communicate with the shore broker on relevant ports. Additionally, deploying intrusion detection systems configured to monitor for anomalous patterns in MOOS message traffic can help identify attempts to inject forged ping messages. Long-term architectural improvements should include implementing mutual TLS authentication for all inter-node communications and adopting zero-trust principles where every node must explicitly authenticate its identity before being granted permission to route or receive bridged data streams, thereby eliminating the possibility of unauthorized redirection through unverified pings.