Essential Moos
Monthly
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Unauthorized runtime route reconfiguration in MOOS essential-moos pShare through 10.0.1 lets any client of the MOOS database issue PSHARE_CMD messages to open new listeners and redirect or duplicate inter-process bus traffic. Because pre-patch builds unconditionally subscribed to PSHARE_CMD, a remote unauthenticated attacker able to publish to the MOOSDB could reroute or mirror sensor/control traffic to attacker-controlled destinations without any credentials. The vendor patch (PR #20) is available and a source-level fix is confirmed, but no public exploit or active exploitation is identified at time of analysis.
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reachable attacker to inject arbitrary variables into the local MOOS publish-subscribe community by sending crafted UDP datagrams to the configured UDPListen port, with full control over spoofed source and community identifiers. The root cause is the absence of any source-address validation in the ListenLoop: the bridge historically accepted datagrams from any sender, trusting the identity claims embedded in the payload. No public exploit has been identified at time of analysis, and a fix is available via upstream PR/commit, though a tagged release version has not been independently confirmed.
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to send crafted UDP packets that pShare republishes verbatim to the local MOOS community under an attacker-chosen identity, or to crash the pShare bridge process with malformed payloads. The root flaw is that pShare's Listener class used raw socket reads without capturing the sender's address, performing no source validation before deserializing and forwarding messages as authoritative MOOS community traffic. A fix is available in upstream commit 53729b6 and PR #18, which adds allowlist-based source filtering and wraps deserialization in exception handling; no public exploit code has been identified and the CVE is not in CISA KEV.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.
Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.
Unauthorized runtime route reconfiguration in MOOS essential-moos pShare through 10.0.1 lets any client of the MOOS database issue PSHARE_CMD messages to open new listeners and redirect or duplicate inter-process bus traffic. Because pre-patch builds unconditionally subscribed to PSHARE_CMD, a remote unauthenticated attacker able to publish to the MOOSDB could reroute or mirror sensor/control traffic to attacker-controlled destinations without any credentials. The vendor patch (PR #20) is available and a source-level fix is confirmed, but no public exploit or active exploitation is identified at time of analysis.
Unauthenticated UDP packet injection in MOOS essential-moos pMOOSBridge through version 10.0.1 allows any network-reachable attacker to inject arbitrary variables into the local MOOS publish-subscribe community by sending crafted UDP datagrams to the configured UDPListen port, with full control over spoofed source and community identifiers. The root cause is the absence of any source-address validation in the ListenLoop: the bridge historically accepted datagrams from any sender, trusting the identity claims embedded in the payload. No public exploit has been identified at time of analysis, and a fix is available via upstream PR/commit, though a tagged release version has not been independently confirmed.
Unauthenticated UDP datagram injection in essential-moos pShare through 10.0.1 allows any network-reachable attacker to send crafted UDP packets that pShare republishes verbatim to the local MOOS community under an attacker-chosen identity, or to crash the pShare bridge process with malformed payloads. The root flaw is that pShare's Listener class used raw socket reads without capturing the sender's address, performing no source validation before deserializing and forwarding messages as authoritative MOOS community traffic. A fix is available in upstream commit 53729b6 and PR #18, which adds allowlist-based source filtering and wraps deserialization in exception handling; no public exploit code has been identified and the CVE is not in CISA KEV.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.