CVE-2026-85431
highMOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen.
Vendor / product: Themoos — essential-moos
MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-03 23:17
Modified: 2026-10-14 15:21
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
themoos / essential-moos ≤10.0.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/themoos/essential-moos/commit/d8441eac57d04ee89e7b82723480d10a558b45d6
Patch / mitigation: https://github.com/themoos/essential-moos/pull/19
References
- https://github.com/themoos/essential-moos disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Es... disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/commit/d8441eac57d04ee89e7b82723480d10a558b45d6 disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/pull/19 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pmoosbridge-unauth... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗