essential-moos EUVD-2026-70807

Exploitation requires network reachability to a MOOS community's MOOSDB and the ability to publish a MOOS variable (PSHARE_CMD) - MOOS provides no authentication, so any client with that reach qualifies. On vulnerable versions through 10.0.1 this works against default configurations because pShare called EnableCommandMessageFiltering(true) unconditionally and thus always honored PSHARE_CMD. The limiting factors are deployment-based rather than technical: the MOOSDB/pShare must be reachable by the attacker (typically these run on isolated vehicle/lab networks), and after the PR #20 patch exploitation additionally requires the operator to have explicitly set AllowRuntimeRouteChanges=true, which defaults to false.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) reflects a network-reachable, low-complexity, unauthenticated attack with high impact, which is consistent with the description: any publisher can reconfigure routing. The real-world caveat is deployment context - MOOS databases are typically run on trusted lab/vehicle networks and MOOS has no built-in authentication, so 'unauthenticated' here means 'any party with network reach to the MOOSDB.' There is no EPSS, KEV, or SSVC data provided; the finding is credited to VulnCheck with a published advisory. No public exploit code is referenced, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. Given the niche footprint of MOOS, the practical priority is high for the specific robotics/autonomy operators who run essential-moos exposed on reachable networks, and low for the broader population. The provided VC:H/VI:H/VA:H is defensible but VA (availability) is the weakest of the three - the primary demonstrated impact is traffic redirection/duplication (confidentiality and integrity of the bus), with availability degradation being a secondary consequence.

An attacker who can reach the MOOSDB on a robotics/autonomy network publishes a crafted PSHARE_CMD message with cmd=output pointing at an attacker-controlled address. pShare opens the new listener/route and begins duplicating live bus traffic (sensor, telemetry, or control variables) to the attacker, who can also use cmd=input to redirect traffic and tamper with delivery. No public PoC is referenced, but the attack requires only the ability to publish a single MOOS variable.