MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. (CVE-2026-85429)

The MOOS-IvP uFldNodeComms component, through version 24.8.1, does not validate the source node identity from the connection source but instead trusts the identity provided in the message body. This flaw enables attackers to craft NODE_MESSAGE packets with spoofed source identities, impersonating other nodes and sending arbitrary variable notifications without validation. This vulnerability is identified as CVE-2026-85429 and is classified under CWE-345 (Insufficient Verification of Data Authenticity). The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can impersonate other nodes by spoofing source identities in NODE_MESSAGE packets, allowing them to post arbitrary variable notifications. This can lead to unauthorized manipulation of data integrity within the system. There is no confidentiality or availability impact reported. The vulnerability does not require privileges or user interaction to exploit and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a fix is released, users should consider additional network-level protections or message validation mechanisms if feasible.