essential-moos CVE-2026-85430

pShare must be deployed with at least one input route configured, which is its standard operational mode for inter-community bridging. The attacker must have UDP network access to the port on which pShare's input route is listening - pShare binds INADDR_ANY, so it accepts from any reachable source on that port by default. No authentication, session state, or prior knowledge beyond the listening port number is required. Exploitation is limited to environments where pShare is actively running; deployments that use MOOS but do not configure pShare input routes are unaffected. The practical attack surface is constrained by network topology: air-gapped or VLAN-isolated lab networks require local or adjacent-segment access, whereas research vessel or remote operations deployments with broader connectivity may be reachable from wider networks. There is no non-default configuration required to be vulnerable - the vulnerable behavior (accept-from-anywhere) was the original and only behavior prior to the patch.

The CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) is technically well-grounded: UDP datagram injection requires no credentials, no session establishment, and no user interaction - any host with network access to the pShare port can exploit this. Integrity impact is high because injected messages enter the MOOS community indistinguishably from legitimate process messages, potentially directing autonomous vehicle actuators or helm processes to execute unintended commands. Availability impact is high via the crash vector, confirmed by the PR commentary that 'one bad input route must not take the whole process with it.' No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the attack technique is trivial - standard UDP tools (netcat, scapy) suffice without any specialized exploit development. EPSS data was not provided in the source intelligence. The realistic threat is context-dependent: MOOS deployments in air-gapped or VLAN-isolated research environments face lower exposure, while field deployments on research vessels or connected test ranges with broader network access face meaningful risk from insider threats or compromised adjacent systems. The combination of no-auth network access, trivial attack mechanics, and potential impact on physical autonomous systems makes this a genuine remediation priority for any active pShare deployment.

An attacker with network visibility to a pShare UDP input route port sends a crafted UDP datagram containing a serialized CMOOSMsg that claims to originate from a trusted helm or navigation process, injecting a spoofed variable update into the MOOS community - potentially causing an autonomous vehicle to alter course, actuate a thruster, or accept a false sensor reading. Alternatively, sending a datagram with intentionally malformed serialization triggers an unhandled exception in the Listener thread, crashing pShare and severing all bridged inter-community communication. No specialized tooling is required; standard network utilities capable of sending raw UDP packets are sufficient.