MOOS core-moos CVE-2026-85451

Exploitation requires multicast-reachable network access to the host running MOOS processes - the attacker must be on a segment where UDP multicast packets to the MOOS default group and port are forwarded to target hosts. No authentication, account, or special software is needed; the passphrase 'elks have been know to waltz' is baked into the public source. The feature must be active, which was the default in versions through 10.4.0 since the passphrase had a non-empty compiled-in value. Post-patch, the feature is disabled by default and exploitation requires an operator to have configured a guessable or exposed passphrase. Exploitation is limited by network topology: internet-routable attacks are not possible unless multicast is bridged or the MOOS network is otherwise accessible from untrusted segments.

The CVSS 4.0 score of 7.1 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H) accurately reflects the attack surface: exploitation is constrained to multicast-reachable network segments - the local LAN, VLAN, or a network path that forwards multicast - which limits opportunistic internet-scale attacks. Within that scope, exploitation is trivially easy: the passphrase is publicly visible in the repository's source history, complexity is low, and no credentials or privileges are required. The primary impact is high availability loss (VA:H) from forced process termination, with minor confidentiality impact (VC:L) from process enumeration. No EPSS data or CISA KEV listing was provided, and no public exploit code has been identified. The bounded deployment footprint of MOOS (academic, research, and defense maritime robotics) limits broad exposure, but within those environments process termination during autonomous operations could have physical safety consequences beyond standard software-layer CIA impact. The 'Authentication Bypass' tag is defensible: the hard-coded passphrase makes the authentication mechanism nominal rather than functional.

An attacker connected to the same network segment as a MOOS deployment sends a UDP multicast packet to the default MOOS multicast group and port containing the publicly known passphrase 'elks have been know to waltz'. Any MOOS process in the default configuration receives the datagram, passes the passphrase check, and immediately calls exit(0), terminating the process. On an AUV or USV running multiple MOOS applications, an adversary in RF or wired network range could sequentially or simultaneously terminate all processes, disabling autonomous operation.