Executive brief
MOOS essential-moos pShare is a network communication component used in robotics and distributed systems to relay messages between publishers and subscribers. The application fails to properly validate PSHARE_CMD messages, allowing any network publisher to reconfigure listeners and routes at runtime. An attacker can exploit this to redirect traffic to attacker-controlled servers, intercept sensitive data, or disrupt operations.
Technical details
The vulnerability is an authorization bypass in pShare's message handling logic. The application accepts PSHARE_CMD messages with cmd=input or cmd=output parameters without proper validation of the sender's privilege level. An attacker with network access to the MOOS communication bus can craft and send these messages to open arbitrary listeners, modify existing routes, or redirect bus traffic. The vulnerable component is located in Share.cpp, which processes incoming PSHARE_CMD messages. This affects essential-moos through version 10.0.1; patches or fixed versions should be available from the MOOS project.
Affected products
- MOOS essential-moos through 10.0.1
Timeline
- 2026-09-03: disclosed