EUVD-2026-70811
GHSA-ppmm-3cm9-263h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable MOOSDB with no authentication required; impact is integrity-only (node impersonation and arbitrary variable injection) with no confidentiality or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.
AnalysisAI
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate legitimate autonomous vehicle nodes and inject arbitrary MOOS variable notifications into the mission coordination fabric. The uFldNodeComms module (FldNodeComms.cpp) accepts the source node identity declared in the NODE_MESSAGE body payload without cross-checking it against the MOOSDB community from which the connection actually originated, a classic CWE-345 insufficient authenticity verification. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the MOOSDB port (typically TCP 9000) used by the target MOOS-IvP deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) accurately captures the network-accessible, unauthenticated, integrity-only nature of the flaw - no confidentiality or availability impact is present, consistent with the attack being impersonation and variable injection rather than data exfiltration or denial of service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix via GitHub PR #122 (https://github.com/moos-ivp/moos-ivp/pull/122) and commit 3907ac07cdfd8a7255d65657dc18dc6b77b30b64. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running MOOS-IvP uFldNodeComms version 24.8.1 or earlier and map network access to the MOOSDB communication bus to identify affected autonomous platforms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbi
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP functio
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to t
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOO
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated atta
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers t
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exh
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attack
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthent
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system m
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending N
Share
External POC / Exploit Code
Leaving vuln.today