ZeroDay Findings
Sign inSign up

Findings

CVE-2026-85424

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges.

Published Sep 3, 2026 · updated Oct 14, 2026 · themoos core-moos

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 3, 2026 · NIST NVD

    Detected

    MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

  2. Oct 14, 2026 · NIST NVD

    Updated

    MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

Affected

  • cpe themoos/core-moosversion unspecified

Sources

  • CVE.orgCVE-2026-85424

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-85424

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDCVE-2026-85424

    MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to

    nvd.nist.gov

References