An unauthenticated remote attacker can trigger a denial of service in EGO-Planner-v2, leading to a complete loss of service availability for the affected system.

The software contains a flaw in the checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions within ego_replan_fsm.cpp that can be triggered by an unauthenticated attacker to cause a denial of service.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk to operational continuity. Successful exploitation results in system downtime, which can disrupt critical robotics or automation workflows relying on the EGO-Planner-v2 framework. This impact is exacerbated by the lack of authentication requirements, allowing remote actors to induce failures without prior access.

Immediate Action: Since a specific patch version is not currently provided, users should monitor the official ZJU-FAST-Lab GitHub repository for updates and commit fixes that supersede commit 5c99a95880401e2599638d567abc0e240396cb42.

Proactive Monitoring: Implement monitoring on the system process status to detect unexpected crashes or service interruptions related to the EGO-Planner-v2 execution environment.

Compensating Controls: Restrict network access to the system running EGO-Planner-v2 to trusted internal segments only, thereby reducing the exposure of the vulnerable callback functions to untrusted remote entities.

Public Exploit Available: No (exploit_available: false)

Given the high severity and potential for service disruption, administrators should prioritize isolating affected instances from public-facing networks. Until an official update is available, maintain strict vigilance over system logs and monitor the project repository for remediation commits. Once a fix is published, apply the update immediately to eliminate the risk of denial of service attacks.