CVE-2026-85433: Missing Authorization in themoos essential-moos

Themoos essential-moos pShare component up to version 10.0.1 fails to enforce proper authorization on PSHARE_CMD messages. This allows unauthenticated publishers to manipulate network routing and listeners dynamically by sending specially crafted PSHARE_CMD messages with cmd=output or cmd=input parameters. As a result, attackers can create new listeners on arbitrary network addresses and redirect or duplicate bus traffic to attacker-controlled endpoints, potentially compromising data confidentiality and integrity.

An attacker with publisher access can reconfigure network routes and listeners at runtime without authorization. This enables interception, redirection, or duplication of bus traffic to attacker-controlled destinations, which can lead to significant confidentiality and integrity breaches. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with no required privileges or user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict publisher access to trusted entities only and monitor for unusual PSHARE_CMD message activity. Do not rely on network segmentation alone as the vulnerability allows runtime reconfiguration of listeners.