Moos Ivp
Monthly
Path traversal in MOOS-IvP SplitHandler (through version 24.8.1) allows an attacker who supplies a crafted alog file to write files outside the intended split output directory on Windows systems. By embedding backslash sequences in variable names within the alog file, the inadequate prior sanitization - which only replaced forward slashes - can be bypassed to escape the output directory boundary and append to arbitrary files. A vendor patch is available via PR#137; no public exploit or KEV listing has been identified at time of analysis.
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers to exhaust the operator display process by flooding it with NODE_REPORT messages carrying arbitrary distinct node names. The ContactLedger class allocates a new tracking entry for every unique vessel name it encounters without enforcing any cap, making the ledger - and everything that iterates it - grow without limit. The result is a stalled or crashed operator situational-awareness display, which is operationally significant in autonomous maritime missions. No public exploit has been identified at time of analysis; an upstream fix capping contacts at 200 has been merged but a tagged release version has not been independently confirmed.
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exhaust the shore broker process's memory and degrade per-iteration CPU performance by sending NODE_BROKER_PING messages with an unlimited number of distinct community names. Each unique community name causes entries to be appended across six parallel in-memory vectors with no eviction policy and no enrollment ceiling, creating unbounded O(n) per-pass overhead. Sustained delivery crashes or disables the shore broker, severing coordination between shore-side operators and autonomous marine vehicles. No public exploit has been identified at time of analysis.
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attacker to register unlimited long-lived REALMCAST_REQ subscriptions with arbitrarily large variable lists, causing the pRealm process to serialize and publish excessive output on every scheduling interval until system resources are exhausted. The vulnerability stems from three absent input limits: no cap on subscription duration, no cap on variable count per subscription, and no ceiling on concurrent pipeway registrations. The fix, confirmed by PR #132 and commit 8a4bb9d9, introduces hard limits of 3600 seconds duration, 64 variables per request, and 64 total concurrent pipeways. No public exploit or KEV listing has been identified at time of analysis.
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthenticated remote attackers to progressively degrade and halt legitimate autonomous vehicle node-report distribution by injecting NODE_REPORT messages with an unbounded stream of distinct fake node names. Each new name triggers an all-pairs distribution walk over the entire ledger (O(n²) work per pass), causing the shoreside broker to consume exponentially increasing CPU as attacker-controlled name diversity grows. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the attack is mechanically trivial against any exposed MOOS message bus.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending NODE_REPORT messages containing leading or trailing whitespace. The three affected functions - isQuoted(), isBraced(), and isChevroned() in MBUtils.cpp - strip whitespace into a modified string but then index that shorter buffer using the original string's length, causing reads past the end of the stripped buffer and exposing adjacent heap memory or crashing the process. No public exploit or CISA KEV listing has been identified at time of analysis; the upstream fix is available as a GitHub commit and pull request but a tagged release version has not been independently confirmed.
Remote code execution in MOOS-IvP through 24.8.1 arises from unsanitized shell metacharacters passed to a `system("mkdir ...")` call inside `SplitHandler::handlePreCheckSplitDir()`, reachable via the `alogsplit` log-processing utility. An attacker who controls either a log file's pathname - including its filename - or the `--dir` command-line parameter can embed shell syntax (e.g., backtick substitution or `$(...)` sequences) that executes arbitrary commands with the privileges of the operator invoking `alogsplit`. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in upstream GitHub PR #127, replacing the dangerous `system()` call with a direct `mkdir(2)` syscall.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOOSDB message bus enroll an attacker-controlled shore route by publishing a spoofed TRY_SHORE_HOST message, which the broker accepts without verifying its source. Once enrolled, the vehicle bridges its configured variables to the attacker's address, redirecting sensor telemetry and control-channel traffic. Reported by VulnCheck; a vendor fix exists as an upstream PR, and there is no public exploit identified at time of analysis.
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated attackers redirect bridged mission variables to attacker-controlled hosts. The shore broker accepts NODE_BROKER_PING messages and builds outbound pShare bridge routes from the sender-supplied HostRecord without verifying the ping's authenticity (CWE-345), so a forged ping can silently reroute autonomous-vehicle telemetry and control traffic. A vendor patch exists (PR #123 / commit 2f5224d) and the flaw was reported by VulnCheck, but no public exploit or active exploitation has been reported.
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate legitimate autonomous vehicle nodes and inject arbitrary MOOS variable notifications into the mission coordination fabric. The uFldNodeComms module (FldNodeComms.cpp) accepts the source node identity declared in the NODE_MESSAGE body payload without cross-checking it against the MOOSDB community from which the connection actually originated, a classic CWE-345 insufficient authenticity verification. An attacker reaching the MOOSDB communication bus can craft packets claiming to originate from any trusted node (e.g., a fleet commander or mission-critical sensor node), silently manipulating inter-vehicle state. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to the MOOSDB as a client execute arbitrary shell commands as the uMemWatch process user. The uMemWatch memory-monitoring tool builds a shell command string that embeds the attacker-controlled MOOS client name as an unquoted stdout-redirection target, so shell metacharacters in the name are interpreted by the shell. Publicly available upstream fix code exists (PR #121); no public exploit was identified at time of analysis, and the flaw is not in CISA KEV.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbitrary shell commands as the iSay process user. The SAY_MOOS variable handler in Sayer.cpp builds a speech command string and passes it straight to system(), so a published message containing backticks or $() command-substitution syntax is executed by the shell. Reported by VulnCheck with a vendor patch available; no public exploit is identified at time of analysis, though the source-level root cause is fully disclosed in the upstream fix commit.
Path traversal in MOOS-IvP SplitHandler (through version 24.8.1) allows an attacker who supplies a crafted alog file to write files outside the intended split output directory on Windows systems. By embedding backslash sequences in variable names within the alog file, the inadequate prior sanitization - which only replaced forward slashes - can be bypassed to escape the output directory boundary and append to arbitrary files. A vendor patch is available via PR#137; no public exploit or KEV listing has been identified at time of analysis.
Unbounded memory consumption in MOOS-IvP pMarineViewer through version 24.8.1 allows unauthenticated network attackers to exhaust the operator display process by flooding it with NODE_REPORT messages carrying arbitrary distinct node names. The ContactLedger class allocates a new tracking entry for every unique vessel name it encounters without enforcing any cap, making the ledger - and everything that iterates it - grow without limit. The result is a stalled or crashed operator situational-awareness display, which is operationally significant in autonomous maritime missions. No public exploit has been identified at time of analysis; an upstream fix capping contacts at 200 has been merged but a tagged release version has not been independently confirmed.
Unbounded resource allocation in MOOS-IvP uFldShoreBroker through 24.8.1 allows a remote unauthenticated attacker to exhaust the shore broker process's memory and degrade per-iteration CPU performance by sending NODE_BROKER_PING messages with an unlimited number of distinct community names. Each unique community name causes entries to be appended across six parallel in-memory vectors with no eviction policy and no enrollment ceiling, creating unbounded O(n) per-pass overhead. Sustained delivery crashes or disables the shore broker, severing coordination between shore-side operators and autonomous marine vehicles. No public exploit has been identified at time of analysis.
Unauthenticated remote resource exhaustion in MOOS-IvP pRealm through version 24.8.1 allows any network-reachable attacker to register unlimited long-lived REALMCAST_REQ subscriptions with arbitrarily large variable lists, causing the pRealm process to serialize and publish excessive output on every scheduling interval until system resources are exhausted. The vulnerability stems from three absent input limits: no cap on subscription duration, no cap on variable count per subscription, and no ceiling on concurrent pipeway registrations. The fix, confirmed by PR #132 and commit 8a4bb9d9, introduces hard limits of 3600 seconds duration, 64 variables per request, and 64 total concurrent pipeways. No public exploit or KEV listing has been identified at time of analysis.
Quadratic algorithmic complexity in MOOS-IvP's uFldNodeComms shoreside broker (versions through 24.8.1) allows unauthenticated remote attackers to progressively degrade and halt legitimate autonomous vehicle node-report distribution by injecting NODE_REPORT messages with an unbounded stream of distinct fake node names. Each new name triggers an all-pairs distribution walk over the entire ledger (O(n²) work per pass), causing the shoreside broker to consume exponentially increasing CPU as attacker-controlled name diversity grows. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the attack is mechanically trivial against any exposed MOOS message bus.
Unbounded memory allocation in MOOS-IvP through 24.8.1 allows unauthenticated network attackers to exhaust host system memory by sending crafted mux packets with arbitrarily large declared packet counts to the Demuxer::addMuxPacket() function. The demultiplexer trusts the integer value in the mux header without a ceiling, causing the process to reserve memory for each declared packet slot. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
Unauthenticated network attackers can trigger out-of-bounds memory reads in MOOS-IvP through version 24.8.1 by sending NODE_REPORT messages containing leading or trailing whitespace. The three affected functions - isQuoted(), isBraced(), and isChevroned() in MBUtils.cpp - strip whitespace into a modified string but then index that shorter buffer using the original string's length, causing reads past the end of the stripped buffer and exposing adjacent heap memory or crashing the process. No public exploit or CISA KEV listing has been identified at time of analysis; the upstream fix is available as a GitHub commit and pull request but a tagged release version has not been independently confirmed.
Remote code execution in MOOS-IvP through 24.8.1 arises from unsanitized shell metacharacters passed to a `system("mkdir ...")` call inside `SplitHandler::handlePreCheckSplitDir()`, reachable via the `alogsplit` log-processing utility. An attacker who controls either a log file's pathname - including its filename - or the `--dir` command-line parameter can embed shell syntax (e.g., backtick substitution or `$(...)` sequences) that executes arbitrary commands with the privileges of the operator invoking `alogsplit`. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in upstream GitHub PR #127, replacing the dangerous `system()` call with a direct `mkdir(2)` syscall.
Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.
Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.
Unauthenticated shore-route hijacking in MOOS-IvP's uFldNodeBroker (through 24.8.1) lets any client of the vehicle's MOOSDB message bus enroll an attacker-controlled shore route by publishing a spoofed TRY_SHORE_HOST message, which the broker accepts without verifying its source. Once enrolled, the vehicle bridges its configured variables to the attacker's address, redirecting sensor telemetry and control-channel traffic. Reported by VulnCheck; a vendor fix exists as an upstream PR, and there is no public exploit identified at time of analysis.
Bridge-route injection in MOOS-IvP's uFldShoreBroker component (through version 24.8.1) lets remote unauthenticated attackers redirect bridged mission variables to attacker-controlled hosts. The shore broker accepts NODE_BROKER_PING messages and builds outbound pShare bridge routes from the sender-supplied HostRecord without verifying the ping's authenticity (CWE-345), so a forged ping can silently reroute autonomous-vehicle telemetry and control traffic. A vendor patch exists (PR #123 / commit 2f5224d) and the flaw was reported by VulnCheck, but no public exploit or active exploitation has been reported.
Node identity spoofing in MOOS-IvP uFldNodeComms through 24.8.1 allows any network-reachable attacker to impersonate legitimate autonomous vehicle nodes and inject arbitrary MOOS variable notifications into the mission coordination fabric. The uFldNodeComms module (FldNodeComms.cpp) accepts the source node identity declared in the NODE_MESSAGE body payload without cross-checking it against the MOOSDB community from which the connection actually originated, a classic CWE-345 insufficient authenticity verification. An attacker reaching the MOOSDB communication bus can craft packets claiming to originate from any trusted node (e.g., a fleet commander or mission-critical sensor node), silently manipulating inter-vehicle state. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote OS command injection in MOOS-IvP's uMemWatch utility (through version 24.8.1) lets attackers who can connect to the MOOSDB as a client execute arbitrary shell commands as the uMemWatch process user. The uMemWatch memory-monitoring tool builds a shell command string that embeds the attacker-controlled MOOS client name as an unquoted stdout-redirection target, so shell metacharacters in the name are interpreted by the shell. Publicly available upstream fix code exists (PR #121); no public exploit was identified at time of analysis, and the flaw is not in CISA KEV.
Remote code execution in MOOS-IvP's iSay module (through version 24.8.1) lets any actor on the MOOS message bus run arbitrary shell commands as the iSay process user. The SAY_MOOS variable handler in Sayer.cpp builds a speech command string and passes it straight to system(), so a published message containing backticks or $() command-substitution syntax is executed by the shell. Reported by VulnCheck with a vendor patch available; no public exploit is identified at time of analysis, though the source-level root cause is fully disclosed in the upstream fix commit.