Vlatko Kosturjak

**Name of the Vulnerable Software and Affected Versions** ugrep versions prior to 7.6.0 **Description** The LZW decompressor contains a heap buffer over-read when processing specially crafted .Z archive files. An attacker can provide malformed .Z files that cause the decompressor to read one byte beyond the allocated heap buffer, which may lead to a process crash. A heap buffer over-read occurs when a program reads more data from the heap than was originally allocated for that buffer. **Recommendations** Update to version 7.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** CDT versions prior to 1.4.5 **Description** An out-of-bounds read occurs in the `opposedVertexInd()` function during the computation of constraint edge intersections in floating point when they round outside adjacent triangles. An attacker can trigger an out-of-bounds array access, leading to a process crash, by providing nearly-degenerate constraint edges through geometry data. **Recommendations** Update to version 1.4.5 or later.

**Name of the Vulnerable Software and Affected Versions** MOOS-IvP versions prior to 24.8.2 **Description** A remote code execution issue exists in the `SplitHandler::handlePreCheckSplitDir()` function of alogsplit. The software fails to sanitize shell metacharacters within log file pathnames, allowing attackers to embed shell syntax in log file names or the `--dir` parameter to execute arbitrary commands with the privileges of the operator running alogsplit. **Recommendations** Update MOOS-IvP to version 24.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** MOOS core-moos versions prior to 10.4.1 **Description** MOOSDB HTTP pages fail to escape database contents during rendering, leading to stored cross-site scripting. This allows a MOOS publisher to set variable values containing malicious script payloads that execute in the browser of operators accessing the web interface. **Recommendations** Update MOOS core-moos to version 10.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** MOOS core-moos versions prior to 10.4.1 **Description** An off-by-one buffer overflow occurs in the `CMOOSSerialPort::GetTelegram()` function. This issue arises when a NUL terminator is written one byte beyond the serial telegram stack buffer. An attacker with control over the serial line can trigger this by sending a full-length telegram, which corrupts the stack and may lead to arbitrary code execution. **Recommendations** Update MOOS core-moos to a version newer than 10.4.0.

**Name of the Vulnerable Software and Affected Versions** MOOS core-moos versions prior to 10.4.1 **Description** A buffer over-read occurs in `CMOOSCommPkt` during the deserialization of a four-byte packet, leading to out-of-bounds memory access. An attacker can exploit this by establishing a TCP connection to the MOOSDB port and sending a specially crafted short packet to read memory before authentication. **Recommendations** Update MOOS core-moos to version 10.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** MOOS-IvP versions prior to 24.8.2 **Description** The SplitHandler fails to properly validate variable names extracted from alog files. On Windows systems, an attacker can provide specially crafted alog files containing backslash sequences in variable names to perform a path traversal, allowing them to escape the designated output directory and append data to arbitrary files. **Recommendations** Update MOOS-IvP to version 24.8.2 or later.

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB CLEAR which resets all variables and clears client mail queues.

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE BROKER PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

**Name of the Vulnerable Software and Affected Versions** MOOS-IvP uFldNodeBroker versions prior to 24.8.2 **Description** The uFldNodeBroker fails to validate the source of `TRY SHORE HOST` messages on the vehicle bus. This allows any publisher to enroll shore routes controlled by an attacker, enabling them to receive bridged vehicle traffic, which may include sensor data and control information. **Recommendations** Update MOOS-IvP uFldNodeBroker to a version newer than 24.8.1.

**Name of the Vulnerable Software and Affected Versions** MOOS essential-moos versions prior to 10.0.2 **Description** A buffer overflow exists in the `CMOOSUDPLink::ReadPktFromArray()` function. Remote attackers can corrupt heap memory by sending crafted UDP datagrams with negative declared lengths to the configured `UDPListen` port. This triggers an oversized `memcpy` operation that writes beyond the destination buffer, resulting in heap corruption and denial of service. **Recommendations** Update MOOS essential-moos to version 10.0.2 or later.