Description

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T23:17:25.183Z",
  "pubdate": "2026-09-03T23:17:25.183Z",
  "executiveSummary": "MOOS core-moos versions up to and including 10.4.0 are susceptible to a critical remote process termination vulnerability located within the SuicidalSleeper component.\nThe vulnerability stems from the use of a hard-coded passphrase utilized for multicast command authorization.\nAny peer capable of reaching the configured multicast group and port can exploit this weakness to issue unauthorized termination commands.\nThis flaw allows for unauthenticated remote denial-of-service (DoS) attacks, enabling attackers to terminate arbitrary MOOS processes within the network environment.\nThe risk is severe as it permits network-adjacent adversaries to disrupt mission-critical autonomous systems or distributed frameworks without requiring valid credentials.\nExploitation requires no authentication, relying solely on network accessibility to the default multicast infrastructure.\nThe impact includes total loss of availability for targeted MOOS nodes and potential systemic instability in distributed robotic or command-and-control applications.",
  "technicalDetails": "The vulnerability resides in the SuicidalSleeper component of core-moos, which is responsible for managing process lifecycles via network-based signaling.\nThe root cause is the implementation of a static, hard-coded passphrase used to authorize commands broadcast over multicast channels.\nBecause the passphrase is embedded directly within the application binary and does not support dynamic configuration or rotating authentication tokens, it effectively acts as a global secret accessible to any party that can reverse-engineer the binary or monitor the multicast traffic.\nThe attack flow begins with the adversary identifying the default multicast group and port utilized by the MOOS instance.\nThe attacker then crafts a network packet formatted to match the internal command structure expected by the SuicidalSleeper component.\nBy including the hard-coded passphrase within the packet header or payload, the attacker successfully bypasses the intended authorization check.\nOnce the packet is received and validated by the target MOOS process, the SuicidalSleeper component interprets the instruction as a legitimate administrative command to terminate the process execution.\nThe vulnerability is present in core-moos through version 10.4.0 and requires no elevated privileges or prior authentication to execute.\nThe network exposure is restricted to the multicast domain; however, in many autonomous or robotics deployments, these networks are often assumed to be trusted, leading to insufficient isolation or access controls.\nThe post-exploitation impact is the immediate cessation of the targeted MOOS node. In distributed environments where MOOS processes are interdependent, triggering the termination of a master node or a critical communication bridge can lead to a cascade failure or complete paralysis of the system-wide operations.\nThere is no remediation currently available that involves changing the passphrase via a configuration file, as the logic is deeply integrated into the codebase, necessitating a patch to the source code to implement robust, non-static authentication mechanisms."
}