EUVD-2026-70813
GHSA-642v-v74x-5j9x
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but needs pAntler in remote-control mode plus MOOSDB write access (AC:H); execvp() yields full host compromise (C/I/A:H), scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.
AnalysisAI
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) pAntler from essential-moos ≤10.0.1 running in headless remote-control mode where CAntler::DoRemoteControl() consumes the MISSION_FILE variable, and (2) network write access to the MOOSDB so the attacker can publish that variable - MOOSDB performs no client authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The impact is genuine full-host RCE (VC:H/VI:H/VA:H), and the vector is network-reachable with no privileges or user interaction (AV:N/PR:N/UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from themoos/essential-moos PR #17 (commit e219f26710927f9c155a6b0dc11e3bd5f3da6730), which introduces the --mission_source=<MOOSName> option and rejects any MISSION_FILE whose publisher does not match the configured owner (Upstream fix available via PR/commit; a tagged patched release version is not independently confirmed from the provided data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of systems running MOOS pAntler version 10.0.1 or earlier, prioritizing production deployments of autonomous robots and vehicles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Essential Moos
View allUnauthorized runtime route reconfiguration in MOOS essential-moos pShare through 10.0.1 lets any client of the MOOS data
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reacha
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge p
Same weakness CWE-494 – Download of Code Without Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today