CVE-2026-85434

Analyzed Analyzed - Analysis Complete

MOOS-IvP uFldShoreBroker Bridge Route Spoofing Vulnerability

Publication date: 2026-09-03

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-09-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85434

EUVD

EUVD-2026-70806

Affected Vendors & Products

Vendor	Product	Version / Range
mit	moos-ivp	to 24.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

MOOS-IvP uFldShoreBroker through version 24.8.1 does not verify the authenticity of node ping messages before creating outbound bridge routes. Attackers can send specially crafted NODE_BROKER_PING messages with manipulated HostRecord data to redirect bridged variables to addresses controlled by the attacker.

Detection Guidance

This vulnerability involves MOOS-IvP uFldShoreBroker failing to verify node ping authenticity, allowing attackers to redirect bridged variables. Detection requires monitoring for unexpected NODE_BROKER_PING messages with crafted HostRecord data. Check logs for unusual bridge route creations or variable redirections to unknown addresses. Use network monitoring tools to inspect traffic for unauthorized uFldShoreBroker communications.

Impact Analysis

This vulnerability allows attackers to intercept or manipulate data being bridged between nodes. If exploited, it could lead to unauthorized access to sensitive information, data tampering, or disruption of communication between systems relying on MOOS-IvP uFldShoreBroker.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, potential data breaches, and associated legal or financial penalties.

Mitigation Strategies

Update MOOS-IvP uFldShoreBroker to version 24.8.1 or later to address the missing node ping authenticity verification. Monitor network traffic for suspicious NODE_BROKER_PING messages with crafted HostRecord data.

Hi! I’m here to help you understand CVE-2026-85434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70