A critical remote code execution vulnerability in the MOOS-IvP iSay component allows unauthenticated attackers to execute arbitrary system commands with the privileges of the iSay process.

The vulnerability exists within the SAY_MOOS variable handler in the iSay application, where unsanitized user-supplied text is passed directly to a shell command. An unauthenticated attacker can publish a crafted SAY_MOOS message containing backticks or command substitution syntax to trigger execution of arbitrary code.

Successful exploitation of this vulnerability allows an attacker to achieve full remote code execution on the host system. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the network. The ability for an unauthenticated user to trigger this flaw without interaction makes it a high-priority threat for any environment running MOOS-IvP.

Immediate Action: Update the moos-ivp package to the latest available version provided by the vendor to incorporate the necessary input sanitization.

Proactive Monitoring: Review system logs for unusual process execution patterns or unexpected shell commands originating from the iSay service. Monitor MOOS message traffic for suspicious strings containing shell metacharacters such as backticks or dollar signs used for command substitution.

Compensating Controls: Implement strict network segmentation to restrict access to the MOOS community interfaces to trusted sources only. If possible, run the iSay process with the least privilege necessary to minimize the impact of a potential compromise.

Public Exploit Available: Unknown.

Due to the critical nature of this remote code execution vulnerability, immediate remediation is required. Organizations utilizing MOOS-IvP should prioritize updating their installations to the latest version. If immediate patching is not feasible, restrict network access to the affected software components to prevent unauthorized message publication.