A missing authorization check in MOOS essential-moos pShare lets any publisher reconfigure network routes and listeners at runtime, allowing an unauthenticated attacker to redirect or duplicate bus traffic to destinations they control.
What Is It
pShare is the bridging component of MOOS essential-moos that shares messages between MOOS communities over the network. Through version 10.0.1, pShare fails to properly authorize PSHARE_CMD messages. Any publisher on the bus can send crafted PSHARE_CMD messages using cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.
The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS 4.0 score of 9.3 (CRITICAL) was also assigned by the reporting source, VulnCheck.
Why It Matters
The vector requires no privileges, no user interaction, and low attack complexity over the network. Because the attacker controls where traffic is sent, the impact spans all three axes; confidentiality (bus traffic duplicated to an attacker endpoint), integrity (routes rewritten at runtime), and availability (traffic redirected away from legitimate consumers). Runtime reconfiguration means no restart or config file change is needed, so the manipulation happens live against a running community.
This CVE does not appear in the CISA KEV catalog in the supplied data, so there is no confirmation of active exploitation and no federal remediation deadline attached to it.
What's Vulnerable
- Vendor: themoos
- Product: essential-moos
- Affected versions: all versions up to and including 10.0.1 (default status: unaffected outside this range)
The vulnerable code path is identified in Essentials/pShare/Share.cpp.
Patch Status
A fix is available upstream. Commit 8e51ced and pull request #20 in the themoos/essential-moos repository address the missing authorization on PSHARE_CMD handling. Operators running 10.0.1 or earlier should upgrade to a build that includes that commit. No vendor-published fixed version number is stated in the supplied data, and no required-action deadline applies absent a KEV listing.
Sources
- NVD, CVE-2026-85433: https://nvd.nist.gov/vuln/detail/CVE-2026-85433
- VulnCheck Advisory: https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pshare-unauthorized-runtime-route-reconfiguration
- themoos/essential-moos (repository): https://github.com/themoos/essential-moos
- Vulnerable code; Share.cpp:813: https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pShare/Share.cpp#L813
- Fix commit 8e51ced: https://github.com/themoos/essential-moos/commit/8e51cedcbd8de9781adec2e9cce354f51750a547
- Pull request #20: https://github.com/themoos/essential-moos/pull/20