EUVD-2026-70814
GHSA-wh57-49q6-m5jh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MOOSDB has no client authentication so any connecting party can set the malicious client name (PR:N/AC:L), and injection yields shell code execution as the uMemWatch user (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.
AnalysisAI
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to the MOOSDB as a client execute arbitrary shell commands as the uMemWatch process user. The uMemWatch memory-monitoring tool builds a shell command string that embeds the attacker-controlled MOOS client name as an unquoted stdout-redirection target, so shell metacharacters in the name are interpreted by the shell. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to a MOOSDB instance that accepts client connections (MOOS provides no client authentication, hence PR:N), and requires that the uMemWatch utility be running and monitoring connected clients - uMemWatch is a diagnostic tool, so deployments not running it are not exploitable via this sink. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) rates this 9.3 and treats it as network-reachable, unauthenticated code execution - defensible given MOOS provides no client authentication, so any party able to open a MOOSDB connection can register an arbitrary client name and trigger the injection when uMemWatch measures it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor: apply the upstream fix from MOOS-IvP PR #121 / commit 0b2bd99, which removes shell usage in uMemWatch by allowlisting filename characters (safeFileNamePart) and running the memory helper via fork/execvp (runToFile) instead of system(); rebuild and redeploy uMemWatch from a patched tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running MOOS-IvP through version 24.8.1 and evaluate MOOSDB network exposure and access controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbi
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP functio
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOO
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated atta
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attack
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthent
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system m
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending N
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate leg
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers t
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exh
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today