Description

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-03T23:17:22.787Z",
  "pubdate": "2026-09-03T23:17:22.787Z",
  "executiveSummary": "The uFldNodeBroker component within MOOS-IvP (up to and including version 24.8.1) contains a critical authentication and authorization vulnerability related to message source validation.\nSpecifically, the application fails to perform adequate verification of the origin of TRY_SHORE_HOST messages transmitted over the vehicle bus.\nThis flaw allows unauthorized entities to register attacker-controlled shore host destinations for data bridging.\nThe vulnerability grants an attacker the ability to intercept sensitive vehicle traffic, including telemetry, sensor data, and mission-critical control information.\nBecause the system trusts incoming TRY_SHORE_HOST packets without validating the publisher's identity, an attacker with access to the vehicle communication bus can hijack data streams.\nThe risk implication is high, as it facilitates man-in-the-middle attacks, potential remote control manipulation, and exfiltration of sensitive tactical data.\nExploitation requires the attacker to be capable of injecting messages onto the vehicle bus, effectively bypassing the intended communication architecture.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation logic within the uFldNodeBroker process, specifically regarding the handling of inter-process or inter-node communications facilitated via the MOOS messaging bus.\nuFldNodeBroker is designed to manage the connectivity between vehicle-side autonomy processes and shore-based support systems by bridging specific data streams. When a TRY_SHORE_HOST message is received, the component updates its internal routing table to facilitate communication with a new shore-side host.\nThe vulnerability occurs because uFldNodeBroker assumes that any publisher on the vehicle bus is an authorized entity. It fails to implement cryptographically signed messages or a whitelist-based identity check to ensure that the source of the TRY_SHORE_HOST message is a trusted administrative process.\nThe attack flow proceeds as follows: First, the attacker identifies the message structure for the TRY_SHORE_HOST command. Second, the attacker utilizes the MOOS messaging interface to publish a malicious TRY_SHORE_HOST message onto the bus. This payload specifies an attacker-controlled network address as the destination for bridged traffic.\nUpon receipt, the uFldNodeBroker updates its configuration to route sensitive information—intended for the legitimate shore station—to the attacker's endpoint. Because the system relies on this message to define its networking behavior, the state of the broker is altered dynamically without manual intervention or further authentication checks.\nPost-exploitation, the attacker maintains a persistent intercept position. By acting as a malicious shore host, the attacker can receive a continuous stream of mission-critical data. Furthermore, depending on the implementation of the communication protocol, the attacker may be able to respond with spoofed data to manipulate vehicle behavior, thereby impacting the integrity and availability of the robotic platform.\nThis issue affects all versions of uFldNodeBroker up to and including 24.8.1. The vulnerability is exploitable by any actor capable of injecting messages into the local or bridged MOOS bus environment, necessitating strict control over the communication medium to prevent unauthorized message publication.\nThe lack of authentication within the MOOS bus itself exacerbates this issue, as uFldNodeBroker inherits the trust-based model of the underlying messaging infrastructure without applying secondary, application-level verification."
}