Description

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:21.770Z",
  "pubdate": "2026-09-03T23:17:21.770Z",
  "executiveSummary": "The MOOS core-moos software package contains a critical authentication bypass vulnerability within its optional MOOSDB HTTP server component.\nThis security flaw allows unauthenticated, remote attackers to interact directly with the MOOS database by injecting or modifying variables.\nBy bypassing mandatory security controls, an unauthorized actor can gain the ability to manipulate actuator states and override critical system commands, effectively granting command and control over the affected MOOS-based system.\nThe vulnerability affects all versions of core-moos up to and including 10.4.0.\nThe primary risk implication is the potential for full system compromise, where an attacker can alter the operational parameters of the robot or autonomous vehicle, leading to physical damage, service disruption, or loss of control.\nThe exploitation process does not require any prior authentication, making the HTTP server a high-exposure attack surface for any network reachable by the adversary.",
  "technicalDetails": "The vulnerability resides in the implementation of the optional MOOSDB HTTP server, which is designed to provide status monitoring and remote interaction capabilities for the MOOS database.\nThe root cause is a failure to enforce authentication or access control lists (ACLs) on the HTTP request handlers that facilitate write operations to the MOOSDB memory space.\nIn a standard MOOS deployment, the MOOSDB acts as the central information exchange hub. The HTTP server interface, intended for introspection, provides a mechanism for clients to send HTTP requests that map directly to internal database variable manipulation calls.\nBecause the server lacks a session management or credential validation layer, any client capable of establishing a TCP connection to the designated HTTP port can issue crafted requests containing key-value pairs.\nThe attack flow begins with the reconnaissance phase, where an attacker identifies an active MOOSDB HTTP server reachable over the network. Once connectivity is established, the attacker sends a specifically crafted HTTP request—typically a GET or POST method—designed to target sensitive variable names.\nThe internal logic of the MOOSDB HTTP server parses these requests and invokes the corresponding database write function without verifying the origin or the legitimacy of the request. This allows the adversary to overwrite critical variables that control system actuators or safety overrides.\nThe impact of this exploit is extensive because the MOOS environment relies on a publish-subscribe model where system behavior is dictated by the current state of these variables. By modifying these, an attacker can override safety-critical parameters or redirect the platform's mission objectives.\nThe vulnerability is persistent in versions up to and including 10.4.0, as the underlying architecture fails to distinguish between authorized administrative traffic and malicious input at the transport layer of the HTTP module.\nThe exploitation does not require special privileges, and the network exposure is limited only by the reachability of the MOOSDB HTTP interface. Post-exploitation, the attacker can achieve full control over the platform's state variables, effectively bypassing any high-level safety logic implemented within the MOOS middleware."
}