MOOS-IvP uFldNodeBroker Shore Route Injection Vulnerability

Executive Summary

MOOS-IvP uFldNodeBroker through version 24.8.1 does not verify the origin of TRY_SHORE_HOST messages on the vehicle bus. This allows any message publisher to add attacker-controlled shore routes. Attackers can send fake shore route messages to intercept vehicle traffic including sensor data and control information.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized TRY_SHORE_HOST messages on the vehicle bus. Check MOOS-IvP logs for unexpected shore route enrollments or traffic bridging. Inspect network traffic for suspicious shore route advertisements using tools like tcpdump or Wireshark to capture and analyze vehicle bus communications.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain access to sensitive vehicle data such as sensor readings and control commands. They might manipulate or eavesdrop on communications between vehicles and shore systems, potentially leading to unauthorized control or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected systems may face compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MOOS-IvP uFldNodeBroker to version 24.8.1 or later. Restrict message publishing permissions on the vehicle bus to trusted entities only. Implement input validation for TRY_SHORE_HOST messages to ensure only authorized sources can enroll shore routes. Monitor network traffic for signs of exploitation.

Useful 0 Not Useful 0