CVE-2026-85430
Themoos Essential-Moos ≤ 10.0.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-85430 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Themoos Essential-Moos. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-70810
Vulnerability Data
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into…
more
the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Explicit requirement to protect session authenticity structurally prevents the weakness for communications.
Integrity verification tools detect (but do not stop) the acceptance of data lacking authenticity.
Cryptographic mechanisms can be used to verify authenticity, thereby preventing acceptance of invalid data.
Associating security attributes with exchanged information supports verification of authenticity.
Integrity protection on transmitted data directly stops acceptance of unauthenticated or altered data.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.24's guidance on identifying protection levels, selecting algorithms/strength for authenticity/integrity (items b,f), using cryptography for transmitted/stored data (c), and key management directly stops many CWE-345 exploits by ensuring verifiable authenticity; however, it leaves a bounded remainder where verification logic itself is flawed or absent (e.g. accepting unverified signatures or weak schemes), as the control depends on correct implementation in other mechanisms.
Secure SDLC incorporates authenticity verification requirements throughout development.
Application security requirements can mandate data authenticity verification mechanisms.
Secure coding practices include implementing proper data authenticity checks.
Security testing can detect missing or weak data authenticity verification.
Secure authentication of data sources ensures only valid, authentic data is accepted.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.