by Kastro
Paper/Archive/CVE-2026-85430

CVE-2026-85430

themoos essential-moos — MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 76.7.767 × 2015.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

Affected

ProductAffectedFixed inSource
essential-moos≤ 10.0.1–CNA

Scores by source

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

patchgithub.com/themoos/essential-moos/pull/18patchgithub.com/themoos/essential-moos/commit/53729b6325a991a8dbd84dcd04e4707f3e592fd6refgithub.com/themoos/essential-mooswriteupgithub.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pShare/Listener.cpp#L132writeupvulncheck.com/advisories/moos-essential-moos-through-10.0.1-pshare-unauthenticated-udp-datagram-republishing