Vendor
moos-ivp
15 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Critical 9.8
MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field …
-
Critical 9.8
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted pay…
-
Critical 9.1
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehic…
-
Critical 9.1
MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
-
Critical 9.8
MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execut…
-
Critical 9.8
MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted r…