CVE-2026-85451CWE-798hardcoded-credentials

CVE-2026-85451

High · published September 4, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-04T03:17Z
Affected products (1)
ProductVersionsFixed in
themoos/core-moos< 10.4.010.4.0
References (5)
https://github.com/themoos/core-moos · [email protected]https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/SuicidalSleeper.cpp#L45 · [email protected]https://github.com/themoos/core-moos/commit/488806a07db9f21eea124f48a9c0392f058f01dc · [email protected]https://github.com/themoos/core-moos/pull/85 · [email protected]https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-remote-process-termination-via-hard-coded-multicast-passphrase · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 22:38Z
    MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase
    cvelistv5