EUVD-2026-70806
GHSA-cgqh-8w72-p7rf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-published ping with no interaction (AV:N/AC:L/PR:N/UI:N); redirected bridges expose and alter mission traffic (C:H/I:H) but do not directly deny service (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
AnalysisAI
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated attackers redirect bridged mission variables to attacker-controlled hosts. The shore broker accepts NODE_BROKER_PING messages and builds outbound pShare bridge routes from the sender-supplied HostRecord without verifying the ping's authenticity (CWE-345), so a forged ping can silently reroute autonomous-vehicle telemetry and control traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to publish NODE_BROKER_PING messages into the MOOS community serviced by uFldShoreBroker (network reachability to the shore broker's pShare/MOOS messaging), affecting MOOS-IvP through 24.8.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) reflects a network-reachable, no-interaction, no-privilege flaw with high confidentiality and integrity impact but no direct availability impact - consistent with rerouting rather than crashing traffic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix delivered in https://github.com/moos-ivp/moos-ivp/pull/123 (commit 2f5224dcd68f92ce9ae10c261bb45dd7000f4d33), which makes uFldShoreBroker reject a NODE_BROKER_PING whose keyword does not match the configured keyword and log a refusal warning; no separately tagged release version was identified, so build from the patched commit - treat this as 'Upstream fix available (PR/commit); released patched version not independently confirmed.' Critically, the fix only takes effect when a non-empty keyword is configured on the broker, so operators must set and enforce a shared keyword (m_keyword) as part of remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running MOOS-IvP uFldShoreBroker version 24.8.1 or earlier and assess their network exposure, particularly shore-broker instances accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbi
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP functio
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to t
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOO
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers t
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exh
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attack
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthent
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system m
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending N
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate leg
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today