{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/core-moos--10.4.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:oxford_university:core-moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-85455"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["core-moos (\u003c= 10.4.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Oxford University"],"content_html":"\u003cp\u003eMOOS core-moos, an open-source project used in autonomous vehicle and robotics research, contains a critical buffer over-read vulnerability in the CMOOSCommPkt component affecting versions through 10.4.0. The flaw resides in the handling of four-byte network packets during the deserialization process. An unauthenticated attacker can exploit this vulnerability by establishing a TCP connection to the MOOSDB service port and transmitting a specifically crafted packet. This interaction triggers an out-of-bounds memory access, which may allow the attacker to read sensitive process memory. This vulnerability is significant for environments deploying MOOS-based systems in networked research or industrial control environments, as it allows for unauthorized data access without requiring prior authentication or valid credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated remote attacker to disclose sensitive information from the memory of the MOOSDB process. This could potentially lead to the exposure of credentials, session tokens, or other private data residing in memory. Given the role of core-moos in autonomous system middleware, the impact is high for researchers and engineers who rely on the platform for mission-critical or sensitive robotics deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade core-moos installations to a version released after 10.4.0 that contains the patch for CVE-2026-85455.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, implement network-level access control lists (ACLs) to restrict access to the MOOSDB TCP port to only known, trusted controller IP addresses.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic logs for connections to the standard MOOSDB port that do not originate from authorized components or management stations.\u003c/li\u003e\n\u003cli\u003eDeploy ingress filtering to block unexpected TCP traffic directed at MOOS-enabled endpoints to limit the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-03T23:29:38Z","date_published":"2026-09-03T23:29:38Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-85455/","summary":"A buffer over-read vulnerability in CMOOSCommPkt allows an unauthenticated remote attacker to trigger out-of-bounds memory access via a crafted four-byte TCP packet.","title":"Buffer Over-Read Vulnerability in MOOS core-moos","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-85455/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moos-ivp:core-moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-85440"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["core-moos (\u003c= 10.4.0)"],"_cs_severities":["critical"],"_cs_tags":["cve","authentication-bypass","middleware","denial-of-service","network-vulnerability","vulnerability","network-security","remote-access"],"_cs_type":"advisory","_cs_vendors":["MOOS-IvP","MOOS"],"content_html":"\u003cp\u003eMOOS core-moos versions up to 10.4.0 contain a critical heap-based buffer overflow vulnerability within the MOOSCommPkt packet handling logic. The issue resides in the HandShake phase, which occurs before authentication is established. An unauthenticated remote attacker can supply a negative value in the packet length field, which bypasses existing signed integer checks within the InflateTo() function. This discrepancy leads to an improper size conversion when the data is passed to the recv() function, causing a heap overflow of a four-byte buffer. Successful exploitation allows an attacker to write arbitrary data into the process memory, potentially leading to remote code execution or application crashes. Given the pre-authentication nature of this flaw, defenders should prioritize patching or restricting access to the MOOS communication ports.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a TCP/IP connection to the target host on the MOOS communication port.\u003c/li\u003e\n\u003cli\u003eAttacker initiates the HandShake phase of the communication protocol.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious packet header containing a negative integer in the packet length field.\u003c/li\u003e\n\u003cli\u003eThe victim application receives the malicious packet via the InflateTo() function.\u003c/li\u003e\n\u003cli\u003eThe vulnerability in the signed integer check allows the negative length to pass validation.\u003c/li\u003e\n\u003cli\u003eThe application performs a heap-based memory allocation based on the unchecked length.\u003c/li\u003e\n\u003cli\u003eThe recv() function processes the attacker-supplied data, resulting in a heap overflow of the internal four-byte buffer.\u003c/li\u003e\n\u003cli\u003eAttacker achieves arbitrary memory write, leading to remote code execution or process termination.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code or cause a denial-of-service condition on affected MOOS installations. This affects systems utilizing MOOS core-moos versions 10.4.0 and earlier. Organizations relying on this software for underwater vehicle communication or similar robotics research environments are at high risk if instances are exposed to untrusted networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch core-moos by upgrading to a version exceeding 10.4.0 immediately upon release of vendor updates.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, restrict access to MOOS communication ports via host-based firewalls or network access control lists to known trusted endpoints only.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for anomalous packet headers directed toward MOOS services, specifically looking for TCP streams containing negative length identifiers in the handshake phase.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-04T01:24:01Z","date_published":"2026-09-03T23:25:19Z","id":"https://feed.craftedsignal.io/briefs/2026-09-moos-heap-overflow/","summary":"A pre-authentication heap overflow vulnerability in the MOOSCommPkt packet handling of MOOS core-moos versions up to 10.4.0 allows remote unauthenticated attackers to perform arbitrary memory writes via crafted packets.","title":"CVE-2026-85440: Heap Overflow in MOOS core-moos","url":"https://feed.craftedsignal.io/briefs/2026-09-moos-heap-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mit:core-moos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-85428"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["core-moos (\u003c= 10.4.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MIT"],"content_html":"\u003cp\u003eMOOS core-moos versions up to and including 10.4.0 contain a critical authentication bypass vulnerability within the optional MOOSDB HTTP server component. This service, which facilitates inter-process communication in autonomy-oriented systems, fails to enforce authentication checks for administrative requests. Consequently, unauthenticated remote attackers can send specially crafted HTTP requests to the MOOSDB service port to write, modify, or inject MOOS variables. This vulnerability is particularly severe because it allows for the unauthorized manipulation of system states, including the modification of actuator commands and override parameters. Successful exploitation grants attackers direct control over operational variables, potentially leading to the compromise of system integrity and safety in environments utilizing core-moos for autonomous decision-making.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 9.8. Exploitation could allow attackers to gain unauthorized control over system operations by injecting or modifying MOOS variables. This poses a significant risk to systems in marine robotics, autonomous vehicle research, and other sectors relying on core-moos, where unauthorized actuator changes could lead to loss of control, physical damage, or mission failure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade core-moos to the latest patched version when available to remediate CVE-2026-85428.\u003c/li\u003e\n\u003cli\u003eImplement network-level segmentation to restrict access to the MOOSDB HTTP server port (default 9000-9005 range) to authorized management IPs only.\u003c/li\u003e\n\u003cli\u003eAudit network traffic for unauthorized HTTP traffic directed at the MOOSDB service port.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-03T23:24:33Z","date_published":"2026-09-03T23:24:33Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-85428/","summary":"The MOOSDB HTTP server in core-moos versions 10.4.0 and earlier contains an authentication bypass vulnerability allowing unauthenticated remote attackers to modify MOOS variables via crafted HTTP requests.","title":"Authentication Bypass in MOOSDB HTTP Server","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-85428/"}],"language":"en","title":"CraftedSignal Threat Feed - Core-Moos (\u003c= 10.4.0)","version":"https://jsonfeed.org/version/1.1"}