Executive brief
MOOS essential-moos is a set of communication utilities used in marine robotics and autonomous systems. pMOOSBridge, a component in this suite, allows UDP-based network communication and fails to validate the source or authenticity of incoming packets. An attacker on the network can send crafted UDP packets to inject arbitrary data into the local MOOS system, potentially disrupting operations, corrupting state, or causing application failures.
Technical details
This is an unauthenticated UDP packet injection vulnerability in the pMOOSBridge component when configured with UDPListen enabled. The vulnerable code in MOOSUDPLink.cpp receives UDP packets without validating the source identity or message authenticity. An attacker on the network (no authentication required) can send crafted UDP packets to the configured listening port to inject arbitrary MOOS variables with spoofed source and community identifiers. This allows complete message forgery within the local MOOS community, enabling data corruption, state manipulation, or denial of service. A patch is likely available in versions after 10.0.1.
Affected products
- MOOS essential-moos through version 10.0.1
Timeline
- 2026-09-03: disclosed