essential-moos CVE-2026-85427

Requires (1) pAntler from essential-moos ≤10.0.1 running in headless remote-control mode where CAntler::DoRemoteControl() consumes the MISSION_FILE variable, and (2) network write access to the MOOSDB so the attacker can publish that variable - MOOSDB performs no client authentication. Pre-patch there is no mission_source owner check, so any publisher is accepted. Limiting factors: the attacker must reach the MOOSDB (typically an onboard/private robotics network rather than the internet), pAntler must be in the remote-control briefing code path, and the crafted mission file must be accepted into the briefing flow (reflected as AC:H/AT:P). No authentication, user interaction, or special client privilege is needed once MOOSDB is reachable.

The impact is genuine full-host RCE (VC:H/VI:H/VA:H), and the vector is network-reachable with no privileges or user interaction (AV:N/PR:N/UI:N). What tempers the 9.2 CVSS 4.0 score is AC:H combined with AT:P: exploitation is not a trivial single packet - pAntler must be running in the headless remote-control code path that consumes MISSION_FILE, the attacker must have network write access to the MOOSDB, and must win against/insert into the mission-briefing flow. There is no EPSS value provided, it is not in CISA KEV, and no exploit code is published, so real-world exploitation is currently theoretical but the source diff plainly confirms the execvp() sink. Net: a real high-severity issue for exposed MOOS deployments, but the practical blast radius is limited by MOOS's typically isolated/onboard network placement rather than internet exposure - verify whether your MOOSDB is reachable beyond the vehicle's trusted network before treating this as internet-facing critical.

An attacker with network reach to an exposed MOOSDB (for example on a shared or inadequately segmented vehicle/lab network) connects as an ordinary MOOS client and publishes a MISSION_FILE variable whose body contains malicious Run entries pointing at attacker-chosen commands. pAntler, running headless in remote-control mode, parses the mission file and hands those entries to execvp(), executing the attacker's programs on the host with pAntler's privileges. No credentials, exploit toolkit, or user interaction is required, though the target must be in the remote-control path and the MOOSDB must be reachable.