essential-moos pMOOSBridge CVE-2026-85431

Exploitation requires that pMOOSBridge is running with UDPListen explicitly configured in the mission file - this is a non-default feature that must be enabled by the operator to bridge MOOS communities over UDP. The attacker must have network-layer reachability to the configured UDP listen port. No authentication, session state, or prior interaction is required once these conditions are met. Exploitation is limited to environments using the pMOOSBridge component for inter-community UDP bridging; MOOS deployments that do not use pMOOSBridge or do not enable UDPListen are not exposed. UDP source addresses are trivially spoofable on networks without ingress filtering (BCP38), removing any practical barrier from IP-based controls at the protocol level alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) reflects a straightforward network-exploitable integrity violation requiring no privileges or user interaction. The score of 8.7 is plausible given the high integrity impact, though real-world risk is constrained by the requirement that UDPListen be explicitly configured and by the niche deployment footprint of MOOS in marine/defense robotics. No KEV listing and no public exploit code exist at time of analysis; EPSS data is not provided. The principal danger is operational integrity compromise in autonomous systems: injected MOOS variables could corrupt sensor readings, mission parameters, or command state presented to an autonomous vehicle. Confidentiality and availability impacts are assessed as none in both the provided vector and this analysis. The UDPListen prerequisite is a meaningful limiting factor - systems not using pMOOSBridge's UDP bridging mode are not exposed.

An attacker with network access to the UDP port configured for pMOOSBridge's UDPListen crafts a UDP datagram claiming to originate from a trusted MOOS community peer and containing forged MOOS variable updates (e.g., spoofed GPS coordinates, falsified sensor readings, or manipulated mission waypoints). The bridge's ListenLoop accepts the packet without source validation and injects the attacker-controlled variables into the local MOOS community, potentially causing an autonomous marine or ground vehicle to act on corrupted state. No public proof-of-concept code has been identified, but the attack is mechanically straightforward given the open-source nature of the MOOS protocol.