CVE-2026-85431: MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection
MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MOOS pMOOSBridgeto a version that resolves this vulnerability.Fixed in 10.0.1 - Configuration
Disable UDPListen in pMOOSBridge to prevent unauthenticated UDP packet injection when the service is exposed to crafted UDP packets.
pMOOSBridge UDPListen = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MOOS essential-moos deployments through version 10.0.1 are exposed when pMOOSBridge is configured with UDPListen. The affected UDP port accepts crafted packets that can inject variables into the local MOOS community.
Does an attacker need credentials or user interaction to exploit it?
No. The issue is unauthenticated and can be exploited by sending crafted UDP packets to the configured port; no privileges or user interaction are required.
What can an attacker falsify through the injected packets?
An attacker can inject arbitrary variables into the local MOOS community and spoof both source and community identifiers.
What can be done if an update cannot be applied immediately?
The provided information identifies UDPListen as the affected configuration. Restricting exposure to the configured UDP port or disabling UDPListen where it is not required can reduce exposure, but no vendor-prescribed workaround is provided.