Description

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:21.910Z",
  "pubdate": "2026-09-03T23:17:21.910Z",
  "executiveSummary": "The uFldNodeComms component within the MOOS-IvP framework (up to version 24.8.1) suffers from an Improper Authentication vulnerability stemming from a lack of source validation for incoming NODE_MESSAGE packets.\nThe system implicitly trusts the node identity field defined within the application-layer message body instead of verifying the identity against the underlying network connection metadata.\nThis design flaw allows a remote attacker to perform identity spoofing, effectively impersonating any node within the MOOS-IvP community.\nBy successfully masquerading as a trusted node, an attacker can inject arbitrary variable notifications into the MOOS database, potentially disrupting mission-critical autonomous behaviors, altering navigation parameters, or triggering unauthorized state transitions in downstream applications.\nExploitation requires network access to the MOOS community communications infrastructure and does not require prior authentication to the target application.\nThe risk is severe as it undermines the integrity of the inter-node communication protocol, potentially leading to total control over the autonomous system's information state.",
  "technicalDetails": "The root cause of this vulnerability lies in the architecture of the NODE_MESSAGE packet processing logic within uFldNodeComms. When the application receives a message, it parses the node identity directly from the encapsulated message payload. It fails to perform an out-of-band validation or a cryptographic check to verify that the identified sender corresponds to the actual established communication channel or origin IP address.\nIn a standard MOOS-IvP deployment, uFldNodeComms acts as a bridge for node communications. Because the application logic relies on the unauthenticated 'source_node' field provided by the sender, any entity capable of transmitting a packet to the uFldNodeComms interface can craft a custom NODE_MESSAGE with an arbitrary 'src_name' parameter.\nThe attack flow proceeds as follows: First, the attacker identifies the target network environment where the MOOS-IvP community operates. Second, the attacker crafts a malicious NODE_MESSAGE packet using the MOOS inter-process communication protocol. The packet is specifically formatted to contain a spoofed source identity representing a legitimate, high-privilege node in the system. Third, the attacker transmits this crafted packet to the uFldNodeComms component. Fourth, uFldNodeComms parses the incoming data, extracting the forged identity from the message body. Fifth, because there is no validation logic to confirm the authenticity of the node identity, uFldNodeComms accepts the message as legitimate.\nOnce accepted, the component processes the variable notifications included in the payload. The affected versions include all MOOS-IvP releases through 24.8.1. Post-exploitation, the attacker can manipulate the global variable space, potentially causing the autonomous system to act upon falsified sensor data or mission directives. The lack of cryptographic verification or connection-binding means that any node connected to the same communication network can trivially impersonate any other node without requiring authentication credentials or specialized privileges beyond network reachability. The impact is essentially a breakdown of the trust model within the MOOS-IvP community, where node identity becomes a user-controllable input rather than a verified metadata attribute."
}