Description

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T23:17:22.060Z",
  "pubdate": "2026-09-03T23:17:22.060Z",
  "executiveSummary": "The MOOS-IvP 'essential-moos' package, specifically versions through 10.0.1, contains a critical authentication bypass vulnerability within the pShare component.\nThe vulnerability arises from a failure to validate the source or integrity of incoming UDP datagrams, allowing an unauthenticated remote attacker to spoof identities within a MOOS community.\nBy injecting crafted messages, an attacker can influence the behavior of the MOOS community by misrepresenting the source of data. Furthermore, the component is susceptible to denial-of-service (DoS) attacks via malformed datagrams that trigger process crashes.\nThe flaw affects any deployment utilizing pShare to facilitate inter-community communication or data sharing. The risk is significant as it undermines the trust model of the messaging architecture, allowing unauthorized command injection or state manipulation.\nExploitation requires network access to the pShare input route, but does not require prior authentication or privileged access to the target host.",
  "technicalDetails": "The vulnerability resides in the pShare process, which is responsible for sharing MOOS variables between communities via UDP/TCP protocols. The root cause is the lack of source authentication and integrity verification for incoming UDP datagrams.\nWhen pShare receives a UDP datagram on its configured input route, it processes the packet and republishes the contents into the local MOOS community. Crucially, the implementation trusts the 'identity' field provided within the incoming datagram payload. There is no cryptographic verification or source address validation performed to ensure that the sender of the UDP packet is the legitimate owner of the claimed identity.\nAn attacker can exploit this by crafting arbitrary UDP packets formatted to meet the pShare input protocol specifications. By setting the identity header in the packet to a trusted node's name, the attacker forces the pShare process to rebroadcast the payload as if it originated from that trusted entity. This allows for arbitrary MOOS variable injection, which can lead to the manipulation of autonomous vehicle or system state logic.\nFurthermore, the pShare input parsing logic lacks sufficient input sanitization. Sending malformed or unexpected UDP datagrams causes the pShare process to encounter an unhandled exception or state violation, resulting in a crash. This leads to a persistent denial-of-service condition, as pShare is typically a critical bridge for communication within the community.\nThe attack flow proceeds as follows: 1) The attacker identifies the UDP port associated with the target pShare input route via network reconnaissance. 2) The attacker crafts a UDP packet containing the spoofed identity and the targeted MOOS variable payload. 3) The attacker transmits the packet to the pShare instance. 4) pShare accepts the input, performs no validation, and publishes the spoofed message to the local MOOSDB. 5) Local processes subscribing to the spoofed variable act on the malicious information. For the DoS variant, the attacker transmits specifically malformed packets designed to trigger memory corruption or logic errors within the parsing function of pShare, causing the process to terminate unexpectedly."
}