EUVD-2026-70807
GHSA-vrg5-259h-pjj5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any unauthenticated MOOSDB publisher can reconfigure routes remotely (AV:N/AC:L/PR:N); duplicating/redirecting bus traffic gives C:H/I:H, with availability only secondarily affected (A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.
AnalysisAI
Unauthorized runtime route reconfiguration in MOOS essential-moos pShare through 10.0.1 lets any client of the MOOS database issue PSHARE_CMD messages to open new listeners and redirect or duplicate inter-process bus traffic. Because pre-patch builds unconditionally subscribed to PSHARE_CMD, a remote unauthenticated attacker able to publish to the MOOSDB could reroute or mirror sensor/control traffic to attacker-controlled destinations without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to a MOOS community's MOOSDB and the ability to publish a MOOS variable (PSHARE_CMD) - MOOS provides no authentication, so any client with that reach qualifies. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) reflects a network-reachable, low-complexity, unauthenticated attack with high impact, which is consistent with the description: any publisher can reconfigure routing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix from upstream PR https://github.com/themoos/essential-moos/pull/20 (commit 8e51cedcbd8de9781adec2e9cce354f51750a547); a released, tagged patched version is not independently confirmed from the input, so this is best described as an upstream fix available via PR/commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running MOOS essential-moos pShare versions 10.0.1 and earlier; categorize by operational criticality and assess which are internet-facing or accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Essential Moos
View allRemote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary program
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reacha
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge p
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today