EUVD-2026-70790
GHSA-gjch-88vq-7gqr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-processing attack requiring user to open a crafted alog file (UI:R); no privileges needed; integrity-only impact (arbitrary file append); no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
AnalysisAI
Path traversal in MOOS-IvP SplitHandler (through version 24.8.1) allows an attacker who supplies a crafted alog file to write files outside the intended split output directory on Windows systems. By embedding backslash sequences in variable names within the alog file, the inadequate prior sanitization - which only replaced forward slashes - can be bypassed to escape the output directory boundary and append to arbitrary files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires: (1) a Windows operating system - the traversal relies on backslash being a path separator, which is Windows-specific behavior; Linux and macOS are not affected; (2) the victim must process a crafted alog file using MOOS-IvP's SplitHandler component - the attacker must first deliver the malicious file to a system running a vulnerable version; (3) no authentication to the MOOS-IvP process itself is required by the attacker, but the attacker must have a delivery path to the operator (social engineering, shared storage, network file share). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N) is consistent with the description: local attack vector requiring passive user interaction (processing a crafted file), with high integrity impact and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by incorporating commit 6f0619e905b325d6b88f76425673045c6e4f6f94 (GitHub PR#137: https://github.com/moos-ivp/moos-ivp/pull/137); a patched tagged release version was not independently confirmed in the available references, so build from the patched source or await an official release announcement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbi
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP functio
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOO
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated atta
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to t
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attack
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthent
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system m
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending N
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate leg
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today