Description

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:22.207Z",
  "pubdate": "2026-09-03T23:17:22.207Z",
  "executiveSummary": "MOOS essential-moos versions up to and including 10.0.1 contain a critical security vulnerability involving unauthenticated UDP packet injection within the pMOOSBridge component.\nThe vulnerability arises when the pMOOSBridge process is configured with the UDPListen directive, exposing the MOOS community to external network input without proper validation or authentication mechanisms.\nAn unauthenticated, remote attacker can exploit this flaw by crafting and transmitting arbitrary UDP packets to the designated listening port.\nSuccessful exploitation allows an attacker to inject unauthorized variables directly into the local MOOS community database.\nBy spoofing source and community identifiers, an attacker can manipulate the state of the MOOS community, potentially hijacking control flows, corrupting data, or misdirecting autonomous vehicle operations managed by the framework.\nGiven that MOOS is frequently utilized in robotics and marine autonomy, the impact of this vulnerability extends to the integrity and reliability of the physical systems it governs.\nThere are no requirements for prior authentication or elevated privileges, making this an accessible entry point for attackers with network visibility to the targeted service.",
  "technicalDetails": "The vulnerability resides within the pMOOSBridge application, specifically in how it processes incoming data packets when the UDPListen configuration option is enabled.\nThe root cause is a fundamental lack of input authentication and origin verification in the UDP packet processing logic of pMOOSBridge. The application implicitly trusts incoming datagrams sent to the configured UDP port.\nThe pMOOSBridge architecture is designed to bridge variables between different MOOS communities. When UDPListen is active, the component initializes a socket listener that performs no cryptographic signature validation or source verification on the packets it receives.\nThe attack flow proceeds as follows: First, the attacker identifies a target system where pMOOSBridge is active with the UDPListen configuration. Second, the attacker constructs a malicious UDP packet containing the MOOS protocol headers required to influence the MOOS DB. These headers include the variable name, data value, and community identifier.\nBecause the system lacks an authentication layer, the attacker can spoof the source identifier and the community name within the packet metadata. When the packet is received by pMOOSBridge, the application deserializes the payload and automatically publishes the injected data into the local MOOS community database (MOOSDB) as if it originated from a legitimate, trusted peer.\nBecause the MOOS protocol relies on a publish/subscribe messaging pattern, injecting these variables can trigger downstream processes that subscribe to the manipulated data. This allows an attacker to influence the behavior of other modules within the system.\nThe exploitation does not require the attacker to have established a session or possess credentials, as the UDP protocol is connectionless and the listener is designed to accept inputs from any source on the network.\nThe post-exploitation impact is severe: an attacker can induce state changes, overwrite mission-critical configuration variables, or disrupt the decision-making loops of the robotic system. In an autonomous environment, this facilitates command injection and potential physical safety compromise by manipulating the internal telemetry and control signals processed by the MOOS middleware.\nThe issue persists across all versions of essential-moos up to and including 10.0.1 where the specified configuration is utilized."
}