Unauthorized Route Reconfiguration in MOOS essential-moos Product

CVE-2026-85433

What is CVE-2026-85433?

The MOOS essential-moos product's pShare component (up to version 10.0.1) contains a vulnerability that fails to properly authorize PSHARE_CMD messages. This flaw allows any unauthorized publisher to manipulate network routes and listeners dynamically. Attackers can exploit this vulnerability by sending specially crafted PSHARE_CMD messages, specifically using cmd=output or cmd=input parameters. Such actions can lead to the opening of new listeners on arbitrary addresses, as well as the redirection or duplication of bus traffic to destinations under the attacker’s control, posing significant security risks to the affected network.

References