Executive brief
MOOS core-moos is a lightweight middleware platform used for inter-process communication in distributed systems. The SuicidalSleeper component uses a hard-coded passphrase for multicast command authorization, allowing any attacker on the network with access to the multicast group to enumerate and forcibly shut down MOOS processes without authentication. This can disrupt mission-critical operations that depend on these processes remaining active.
Technical details
The vulnerability exists in the SuicidalSleeper component of MOOS core-moos through version 10.4.0, which handles multicast-based process management. The component uses a hard-coded passphrase to authorize multicast commands, failing to implement proper authentication. An attacker on the same network segment with multicast reachability can send specially crafted commands to the default multicast group and port to enumerate running MOOS processes and send termination signals, causing remote process shutdown. The vulnerability requires network adjacency (multicast reachability) but no authentication credentials. A patch or version update addressing the authentication mechanism is required to resolve this issue.
Affected products
- MOOS core-moos through 10.4.0
Timeline
- 2026-09-03: disclosed
- other: CVE-2026-85451 assigned