CVE-2026-85451

MOOS core-moos through 10.4.0 relies on a hard-coded passphrase to authorize multicast shutdown commands handled by its SuicidalSleeper component (CWE-798, use of hard-coded credentials). Because the default MOOS multicast group and port are used, any peer reachable on the adjacent network segment can join the group, enumerate running MOOS processes, and issue authorized termination commands. An attacker gains the ability to remotely shut down individual MOOS processes or an entire MOOS community, producing high availability impact (denial of service) with only limited confidentiality loss through process enumeration. Anyone running MOOS core-moos up to and including 10.4.0 with default multicast settings — typically robotics and marine-autonomy deployments — is affected. No exploitation is known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade to a core-moos release newer than 10.4.0 when a patched version becomes available, as the advisory does not specify a fixed version. Until then, restrict multicast reachability by firealling or segmenting the default MOOS multicast group and port, and disable or reconfigure the SuicidalSleeper component where it is not required. Audit running hosts for listeners on the default MOOS multicast group/port and check active MOOS missions for SuicidalSleeper usage.