Executive brief
MOOS core-moos is a lightweight middleware messaging system used in robotics and autonomous systems applications. The wire protocol lacks authentication, allowing unauthenticated attackers to connect to the database server with full privileges including database reset and client command execution. This could result in complete disruption of dependent applications, data loss, and operational failure.
Technical details
The vulnerability is an authentication bypass in the MOOS wire protocol (CWE-306: Missing Authentication). Unauthenticated clients can connect to the MOOSDB server and bypass compile-time protocol string checks, allowing arbitrary client names and full access to publish, subscribe, and privileged operations. The DB_CLEAR command allows attackers to reset all database variables and clear client mail queues. The attack requires network access to the MOOSDB port but no authentication credentials or user interaction. Patch status is not explicitly documented in the advisory.
Affected products
- MOOS core-moos through 10.4.0
Timeline
- 2026-09-03: disclosed