CVE-2026-85424

MOOS core-moos through 10.4.0 implements its inter-process (wire) protocol with no authentication (CWE-306), so any client that can reach a MOOSDB server over the network is accepted without credentials. An unauthenticated attacker can bypass the compile-time protocol string check and connect under arbitrary client names, gaining full publish and subscribe rights plus privileged operations such as DB_CLEAR. With these rights, an attacker can reset all variables and clear client mail queues, inject or spoof published data into running processes, and otherwise tamper with or disrupt the middleware's data flow, which the 9.3 critical CVSS 4.0 score reflects (network vector, no privileges, high impacts). Anyone running MOOS core-moos up to and including 10.4.0 is affected, with the greatest risk where the MOOSDB listener is reachable by untrusted network peers, as can occur in shared lab, simulation, or vehicle-network deployments. No exploitation has been reported: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at 0.5%.

What to do: No fixed release is specified in the available data, so check the MOOS project for an updated core-moos release addressing the unauthenticated wire protocol and upgrade as soon as one is available. In the interim, restrict network access to the MOOSDB listener (firewall or allowlist only trusted hosts) and confirm that no MOOSDB instance is reachable from untrusted networks or shared lab/simulation segments. Watch for clients registering under unexpected or arbitrary names on running MOOSDB instances as an indicator of probing.