Executive brief
MOOS-IvP is an autonomy software suite used for controlling autonomous vehicles, particularly marine robots. A vulnerability in the SplitHandler component fails to properly validate variable names when processing log files, allowing attackers to write files outside the intended directory by using path traversal sequences. On Windows systems, this could allow arbitrary file writes if an attacker-controlled log file is processed.
Technical details
The vulnerability is a path traversal flaw in the SplitHandler component of MOOS-IvP versions through 24.8.1. The SplitHandler processes alog files but fails to validate variable names before using them to construct file paths. Attackers can craft alog files containing backslash sequences (on Windows) in variable names to escape the designated split output directory. The attack requires the victim to process a malicious alog file with the SplitHandler tool. Successful exploitation allows writing or appending to arbitrary files on the system with the privileges of the MOOS-IvP process, potentially affecting system integrity and availability.
Affected products
- MOOS-IvP MOOS-IvP through 24.8.1
Timeline
- 2026-09-03: disclosed