CVE-2026-85451 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The core-moos software suite, specifically versions up through 10.4.0, contains a critical security vulnerability within its SuicidalSleeper component that allows for remote unauthorized termination of processes. This flaw stems from an insecure design choice where the mechanism responsible for authorizing multicast commands relies on a hard-coded passphrase rather than dynamic or authenticated credentials. The SuicidalSleeper is designed to monitor system health and can terminate other MOOS processes if certain conditions are met, but its authorization logic fails to verify the identity of the sender beyond checking against this static secret string. Consequently, any entity capable of reaching the multicast network segment where these commands are broadcasted can exploit this weakness without needing prior authentication or access credentials.
From a technical perspective, the vulnerability exploits the default configuration of the MOOS middleware which utilizes specific multicast groups and ports for inter-process communication. Because the passphrase used to authorize termination commands is hardcoded into the binary, it remains constant across all installations unless manually altered by an administrator during deployment. An attacker who has network access to this multicast domain can easily discover these processes through standard enumeration techniques such as listening to multicast traffic or sending probe packets that elicit responses from active MOOS nodes. Once a target process is identified, the attacker constructs and sends a specially crafted termination command containing the known hard-coded passphrase. The SuicidalSleeper component accepts this command because it matches the expected authorization string, leading directly to the immediate shutdown of the targeted application instance.
The operational impact of this vulnerability is severe in environments where MOOS is used for mission-critical applications such as autonomous underwater vehicles, unmanned aerial systems, or multi-agent robotic swarms. The ability to remotely terminate processes disrupts the coordination and functionality of these complex systems. In a distributed architecture, losing control over individual nodes can lead to cascading failures, loss of situational awareness, and potential physical damage if the affected system is in motion or performing sensitive operations. This lack of integrity protection means that an attacker does not need elevated privileges on any single host; network access alone is sufficient to cause denial of service by killing essential services required for system stability and mission execution.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-798, which describes the use of hard-coded credentials that cannot be changed by users, and CWE-250, which refers to executing code or commands without checking for necessary privileges. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving command and script execution via network services, specifically leveraging multicast protocols for lateral movement or disruption. The attack vector is classified as remote with low complexity due to the static nature of the authentication mechanism and the open accessibility of multicast traffic within local networks.
To mitigate this risk, organizations deploying MOOS core-moos must immediately implement compensating controls since patching may not be available in older versions. Network segmentation should be enforced to restrict access to the specific multicast groups and ports used by MOOS components, ensuring that only trusted hosts can communicate with these services. Additionally, administrators should configure firewalls or network access control lists to drop unauthorized traffic on these designated interfaces. If possible, upgrading to a version of core-moos where this issue has been resolved is the most effective long-term solution. Until then, monitoring multicast traffic for anomalous termination commands and restricting physical or logical network access to MOOS-enabled devices are essential steps to maintain system integrity and availability.