Description

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:21.170Z",
  "pubdate": "2026-09-03T23:17:21.170Z",
  "executiveSummary": "The MOOS core-moos software package through version 10.4.0 contains a critical authentication vulnerability within its wire protocol.\nThis flaw allows remote, unauthenticated clients to establish connections with the core MOOS database, effectively bypassing existing security controls.\nThe vulnerability grants unauthorized actors full access to publish and subscribe primitives, as well as the ability to execute destructive administrative commands such as DB_CLEAR.\nBy manipulating the client connection sequence, an attacker can assume arbitrary identities, facilitating unauthorized interaction with the message bus.\nThe lack of cryptographic or token-based authentication mandates that any system running an exposed MOOS instance is at risk of complete operational disruption, state reset, and data exfiltration from message queues.\nNo specific privileges are required to initiate this attack; a network-reachable path to the MOOS database port is the sole prerequisite for exploitation.\nThis represents a significant risk to autonomy and robotics frameworks that rely on MOOS for inter-process communication, as the integrity and availability of the entire message-passing architecture are compromised.",
  "technicalDetails": "The vulnerability stems from an architectural deficiency in the MOOS wire protocol where the handshake and subsequent command execution phases lack mutual authentication or authorization verification.\nCore-moos implementations through 10.4.0 fail to validate the legitimacy of incoming connections, permitting any entity capable of transmitting TCP packets to the database port to register as a valid participant.\nThe root cause is an over-reliance on compile-time protocol string checks intended to verify client identity, which can be easily bypassed by malformed or spoofed packets. Because the protocol does not enforce a secure handshake (such as TLS with mutual certificate verification or HMAC-based challenge-response), the server assumes that any established socket connection is a trusted internal process.\nAttack flow involves the following stages: First, the attacker initiates a standard TCP connection to the MOOS database port. Second, the attacker sends a crafted registration message, bypassing the compile-time string validation by providing arbitrary client names. Third, upon successful connection, the server grants the unauthorized client full read/write access to the variable namespace.\nThe attacker can then perform full publish and subscribe operations, intercepting sensitive operational data flowing between legitimate system modules. More critically, the attacker can transmit the DB_CLEAR command, which forces the database to immediately purge all stored variables and flush the mail queues of all connected clients.\nThis state-wiping action results in an immediate denial-of-service condition for the entire MOOS community, causing all connected nodes to lose their internal state and communication context. The exploitation is trivial as it requires no prior knowledge of existing system credentials, only the ability to initiate network traffic to the service port. Given that MOOS is often deployed in networked robotics and research environments where perimeter security may be minimal, the exposure is considered high across all deployments utilizing default configurations."
}