Security readout for executives and security teams
Plain-English summary
MOOSDB accepts network clients without authentication, potentially giving any reachable attacker the same publish, subscribe, and database-clearing capabilities as trusted clients. This could expose operational data, permit unauthorized changes, or disrupt dependent systems by resetting variables and clearing queued messages.
Executive priority
Treat internet-reachable or operationally critical MOOSDB deployments as immediate containment priorities. Unauthorized database clearing could interrupt dependent systems, while publishing and subscription access could alter or expose operational information. Isolate affected services now and track an official vendor-supported correction.
Technical view
The MOOS wire protocol lacks client authentication. The described compile-time protocol-string check is bypassable and does not establish identity. An unauthenticated client can use arbitrary client names and invoke publish, subscribe, and DB_CLEAR operations. The source bundle identifies core-moos through 10.4.0 as affected, although its structured affected-version metadata is inconsistent.
Likely exposure
Highest risk applies where MOOSDB is reachable from untrusted networks or shared environments. Systems isolated behind effective network controls have reduced exposure but remain vulnerable to compromised or unauthorized internal clients. Confirm deployed versions and actual reachability; the supplied version metadata is inconsistent.
Exploitation context
CVSS 3.1 is 9.8, reflecting remote, low-complexity access without privileges or user interaction and high confidentiality, integrity, and availability impact. The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. A public proposed fix exists, but the bundle says its pull request is unmerged.
Researcher notes
The verified sink reference supports DB_CLEAR handling, while the advisory and CVE description support unauthenticated protocol access and broader privileges. The version claim says through 10.4.0, but the structured affected entry lists version "0" with default unaffected status. Validate applicability directly against deployed code and vendor guidance. No active exploitation evidence is supplied.
Mitigation direction
- Restrict MOOSDB access to explicitly trusted hosts and isolated management networks.
- Block internet and untrusted-segment reachability using host and network controls.
- Monitor vendor guidance and upgrade when an official corrected release becomes available.
- Evaluate the proposed fix in testing; do not assume an unmerged change is supported.
- Review trusted clients and network boundaries for unauthorized access paths.
Validation and detection
- Inventory core-moos and MOOSDB versions across production, development, robotic, and research environments.
- Verify whether MOOSDB ports are reachable from internet, user, wireless, or shared networks.
- Confirm network controls permit only documented MOOS clients and administration systems.
- Review logs and telemetry for unknown client names, unexpected publications, subscriptions, or database resets.
- After remediation, validate isolation and authorized-client functionality in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-85424 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull Request #84CVE reference, VulnCheck · issue-tracking, patch
- Proposed fix commit (pull request not merged)CVE reference, VulnCheck · patch
- https://github.com/themoos/core-moosCVE reference, VulnCheck · product
- MOOSDB.cpp (verified sink)CVE reference, VulnCheck · technical-description
- VulnCheck Advisory: MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEARCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.