CVE-2026-85435 in MOOS-IvP
Summary
by MITRE • 09/04/2026
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in MOOS-IvP versions through 24.8.1 centers on a critical authentication failure within the uFldNodeBroker component, specifically regarding the handling of TRY_SHORE_HOST messages transmitted over the internal vehicle bus. This architecture is commonly deployed in autonomous underwater vehicles and other unmanned systems where robust communication between onboard sensors, control logic, and external shore stations is essential for mission execution. The core technical flaw lies in the absence of source validation when processing these specific message types. In a secure implementation, any request to establish or modify shore host routes should be strictly authenticated and authorized, ensuring that only trusted entities with valid credentials can influence routing tables. However, due to this oversight, the system accepts TRY_SHORE_HOST messages from any publisher on the bus without verifying their legitimacy or origin. This lack of access control creates a direct path for privilege escalation within the local network environment of the vehicle.
From an operational perspective, this flaw allows an attacker who has gained even minimal foothold on the internal vehicle bus to manipulate routing configurations at will. By publishing malicious shore route messages, the adversary can redirect traffic intended for legitimate shore stations through their own controlled endpoints. This effectively turns the autonomous system into a man-in-the-middle device, enabling the interception of sensitive operational data. The impact is severe because it compromises both confidentiality and integrity. Sensor data, which may include high-resolution sonar imagery or environmental telemetry critical to mission success and national security, can be exfiltrated. Furthermore, control information flowing between onboard systems and shore commands can be intercepted, modified, or delayed, potentially leading to loss of vehicle control or execution of unauthorized maneuvers. This scenario aligns with the MITRE ATT&CK technique for Interception of Unencrypted Data Transports within a local network context, as well as CWE-287 regarding Improper Authentication, where the system fails to verify the identity of an actor before granting access to critical resources.
The exploitation of this vulnerability does not require complex payload construction or remote code execution exploits; it relies solely on the ability to inject messages into the communication bus. This simplicity makes it a high-risk issue for any deployment relying on MOOS-IvP, particularly in contested environments where adversaries may have physical access to docking stations or compromised shore-side equipment that can bridge onto the vehicle network. The lack of message origin validation undermines the fundamental trust model assumed by many autonomous systems, which often operate under the premise that internal bus communications are safe from external tampering if perimeter defenses hold. However, as demonstrated here, once an attacker breaches the perimeter, lateral movement to critical routing components is trivial due to this specific design flaw.
Mitigation strategies must focus on implementing strict access controls and message authentication mechanisms within the uFldNodeBroker module. Developers should enforce cryptographic signing of all TRY_SHORE_HOST messages, ensuring that only nodes with valid digital certificates can request route changes. Additionally, role-based access control lists should be applied to restrict which processes are permitted to publish routing-related messages. Network segmentation techniques can also help isolate critical routing functions from less trusted subsystems, reducing the attack surface available to potential adversaries. Until a patched version is deployed, operators should monitor bus traffic for anomalous route modification attempts and limit physical access to vehicle communication ports to prevent unauthorized injection of malicious payloads into the internal network infrastructure.