MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRYSHOREHOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.