CVE-2026-85430— MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing
Quick assessment
Affected
themoos essential-moos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MOOS 项目（essential-moos）版本至 10.0.1 在 pShare 组件中存在一个认证绕过漏洞。pShare 会接受来自任意来源的 UDP 数据报，并在保持攻击者声称的身份不变的情况下重新发布这些消息。攻击者可以向 pShare 的输入路由发送精心构造的 UDP 数据报，从而以伪造的身份向本地 MOOS 社区注入消息；或者发送格式错误的数据报，导致 pShare 进程崩溃。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85430
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing
Source: CVE Program / CVE List V5
Vulnerability Description
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themoos | essential-moos | 0 ~ 10.0.1 | - |
|
II. Public POCs for CVE-2026-85430
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85430
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85430 (2)
Vendor Advisories for CVE-2026-85430 (1)
Security Blog Posts for CVE-2026-85430 (1)
Other References for CVE-2026-85430 (1)
Same Patch Batch · themoos · 2026-09-03 · 18 CVEs total
| CVE-2026-85440 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet |
| CVE-2026-85433 | 9.8 CRITICAL | MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration |
| CVE-2026-85424 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_ |
| CVE-2026-85428 | 9.8 CRITICAL | MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write |
| CVE-2026-85452 | 8.8 HIGH | MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers |
| CVE-2026-85455 | 8.2 HIGH | MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet |
| CVE-2026-85432 | 8.2 HIGH | MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity |
| CVE-2026-85427 | 8.1 HIGH | MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSI |
| CVE-2026-85443 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service |
| CVE-2026-85431 | 7.5 HIGH | MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection |
| CVE-2026-85441 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Leng |
| CVE-2026-85450 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion |
| CVE-2026-85436 | 7.5 HIGH | MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length |
| CVE-2026-85442 | 7.5 HIGH | MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation |
| CVE-2026-85451 | 7.1 HIGH | MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphra |
| CVE-2026-85454 | 6.1 MEDIUM | MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling |
| CVE-2026-85453 | 6.1 MEDIUM | MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting |
IV. Related Vulnerabilities
Same product: essential-moos
-
CVE-2026-85436
MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corrupti -
CVE-2026-85433
MOOS essential-moos through 10.0.1 pShare Unauthorized Runti -
CVE-2026-85431
MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticat -
CVE-2026-85427
MOOS essential-moos through 10.0.1 pAntler Remote Code Execu
Same vendor: themoos
-
CVE-2026-85455
MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via -
CVE-2026-85454
MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in -
CVE-2026-85453
MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross -
CVE-2026-85452
MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MO -
CVE-2026-85451
MOOS core-moos through 10.4.0 Remote Process Termination via
Same weakness: CWE-345
-
CVE-2026-85435
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore -
CVE-2026-85434
MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injecti -
CVE-2026-85431
MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticat -
CVE-2026-85429
MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Sp -
CVE-2026-84767
WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vu
V. Comments for CVE-2026-85430
No comments yet