A critical flaw in MOOS-IvP's uFldNodeBroker lets any publisher on the vehicle bus enroll an attacker-controlled shore route and receive bridged vehicle traffic, including sensor and control data.
What Is It
MOOS-IvP uFldNodeBroker through version 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus. Because the origin of these messages is never checked, any publisher can enroll a shore route of its choosing. An attacker who publishes malicious shore route messages gets vehicle traffic bridged to a destination they control; sensor data and control information included.
The issue is classified as CWE-345 (Insufficient Verification of Data Authenticity) and carries a CVSS 3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. A secondary CVSS 4.0 assessment scores it 9.3 (CRITICAL).
Why It Matters
The scoring tells the story: network attack vector, low complexity, no privileges, and no user interaction required, with high impact to both confidentiality and integrity. There is no authentication barrier to clear. An attacker positioned to publish on the vehicle bus can silently redirect the data stream between vehicle and shore, exposing telemetry and gaining a foothold in the control path.
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog based on the supplied data, and no KEV-confirmed active exploitation or KEV remediation deadline applies.
What's Vulnerable
- Vendor/Product: moos-ivp / moos-ivp
- Affected versions: all versions through and including 24.8.1 (default status: unaffected outside this range)
- Component: uFldNodeBroker (
ivp/src/uFldNodeBroker/NodeBroker.cpp)
Patch Status
The NVD record is in Received status, published 2026-09-03, with the disclosure attributed to VulnCheck. Upstream references point to a fix: commit d66394f and pull request #124 in the moos-ivp repository. Operators running 24.8.1 or earlier should track that commit and PR and update to a build that includes the source-validation fix. No vendor-published fixed version number is stated in the supplied data.
Sources
- NVD, CVE-2026-85435: https://nvd.nist.gov/vuln/detail/CVE-2026-85435
- VulnCheck Advisory: https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodebroker-unauthenticated-shore-route-enrollment
- MOOS-IvP Repository: https://github.com/moos-ivp/moos-ivp
- Vulnerable Code; NodeBroker.cpp: https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeBroker/NodeBroker.cpp#L97
- Fix Commit: https://github.com/moos-ivp/moos-ivp/commit/d66394f576cae0c63c0a777760e1595802b83edf
- Pull Request #124: https://github.com/moos-ivp/moos-ivp/pull/124