Executive brief
MOOS-IvP iSay is a component used in autonomous robotic systems, particularly marine vehicles, to provide voice output capabilities. A flaw in how it processes SAY_MOOS messages allows attackers to execute arbitrary system commands on the machine running iSay, potentially giving an attacker full control over the robotic platform and any data it processes.
Technical details
The vulnerability is a command injection flaw in the SAY_MOOS variable handler within iSay's Sayer component. The handler passes unsanitized user-supplied text directly to shell command execution, allowing attackers to inject backticks or command substitution syntax (e.g., $(...)) to break out of the intended command context. An attacker with network access to publish MOOS messages can craft a malicious SAY_MOOS message containing shell metacharacters to achieve remote code execution as the iSay process user. The vulnerability affects iSay through version 24.8.1. No patch availability information is provided in the advisory.
Affected products
- MOOS-IvP iSay through 24.8.1
Timeline
- 2026-09-03: disclosed