EUVD-2026-70808
GHSA-5cg3-9gv9-c53v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated MOOS client connection (PR:L); scope change because writes are attributed to other broker clients (S:C); no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
AnalysisAI
MOOSDB in core-moos through 10.4.0 accepts wire-supplied source identifiers verbatim instead of enforcing the authenticated connection identity, enabling any authenticated MOOS client to forge message origins and impersonate arbitrary registered processes within the broker. Exploitation allows an attacker to attribute writes to a victim client and invoke subscription cancellations as if originating from that client, corrupting the publish-subscribe integrity of the entire MOOS community. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have completed the MOOSDB TCP handshake with a valid MOOS client name, meaning they need network reachability to the MOOSDB port and the ability to register as any MOOS client identity (no specific credential beyond connection establishment is required by default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector assigns PR:N (no privileges required), which directly contradicts the CVE description's explicit qualifier 'authenticated attackers' - the attacker must first complete a MOOS client handshake, placing true privilege requirements at PR:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is available as GitHub commit 26308f0e393f0e80bfa09b275891e776b8dbf522 (PR #76 at https://github.com/themoos/core-moos/pull/76); operators should build from this commit or a subsequent tagged release that incorporates it, though a specific patched release version has not been independently confirmed and should be verified with themoos maintainers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running core-moos and identify current deployed versions to determine affected installations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution risk in MOOS core-moos through 10.4.0 arises from a pre-authentication heap overflow in MOOSCommPk
Unauthenticated variable write in MOOS core-moos through 10.4.0 lets any client that can reach the optional MOOSDB HTTP
Unauthenticated full compromise of the MOOSDB message bus in MOOS core-moos through 10.4.0, where the wire protocol perf
Unauthenticated buffer over-read in MOOS core-moos through 10.4.0 allows any attacker with TCP access to the MOOSDB port
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of s
Unauthenticated denial-of-service in MOOS core-moos through 10.4.0 allows remote attackers to crash the central MOOSDB p
Resource exhaustion in the MOOSDB HTTP server component of MOOS core-moos through 10.4.0 allows unauthenticated remote a
Denial-of-service in MOOS core-moos through 10.4.0 allows any unauthenticated network peer to permanently freeze the MOO
Remote process termination in MOOS core-moos through 10.4.0 allows any multicast-reachable attacker to forcibly shut dow
Stored cross-site scripting in MOOS core-moos through 10.4.0 allows any MOOS publisher to inject script payloads into th
Stack corruption with potential code execution in MOOS core-moos through version 10.4.0 arises from an off-by-one error
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today