MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll… (CVE-2026-85435)

The MOOS-IvP uFldNodeBroker component up to version 24.8.1 fails to validate the origin of TRY_SHORE_HOST messages on the vehicle bus. This lack of source validation permits any publisher to enroll shore routes controlled by an attacker. Consequently, an attacker can inject malicious shore route messages to receive bridged vehicle traffic, potentially exposing sensitive sensor data and control information. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity). The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an attacker to enroll malicious shore routes on the vehicle bus, enabling interception of bridged vehicle traffic. This includes sensitive sensor data and control information, which could compromise the confidentiality and integrity of the vehicle's operational data. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should monitor vendor communications for updates and consider restricting access to the vehicle bus to trusted publishers only if feasible.