MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/themoos/essential-moos/commit/d8441eac57d04ee89e7b82723480d10a558b45d6 Patch
- https://github.com/themoos/essential-moos/pull/19 Patch, Exploit
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · themoosNVD modified 2026-10-14 15:21
Affected (CPE criteria) 1
cpe:2.3:a:themoos:essential-moos:*:*:*:*:*:*:*:*
References 5
- https://github.com/themoos/essential-moos Product
- https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pMOOSBridge/MOOSUDPLink.cpp#L21 Product
- https://github.com/themoos/essential-moos/commit/d8441eac57d04ee89e7b82723480d10a558b45d6 Patch
- https://github.com/themoos/essential-moos/pull/19 Patch, Exploit
- https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pmoosbridge-unauthenticated-udp-packet-injection Third Party Advisory, VDB Entry