What’s Vulnerable › Vulnerabilities

CVE-2026-85435: MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-10-14
• Weakness: CWE-345

Description

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

Affected products

• moos-ivp: before 24.8.1 — fixed in 24.8.1

How to fix

Upgrade to a fixed version: moos-ivp 24.8.1. Check the vendor advisory for mitigations.

References

• https://github.com/moos-ivp/moos-ivp
• https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeBroker/NodeBroker.cpp#L97
• https://github.com/moos-ivp/moos-ivp/commit/d66394f576cae0c63c0a777760e1595802b83edf
• https://github.com/moos-ivp/moos-ivp/pull/124
• https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodebroker-unauthenticated-shore-route-enrollment

Get alerted when CVE-2026-85435 or the next vulnerability affects your stack