A critical command injection vulnerability in the MOOS-IvP uMemWatch component allows unauthenticated attackers to execute arbitrary system commands with the privileges of the application process.

The vulnerability exists in the measureMemory function within MemWatch.cpp, where attacker-controlled client names are used to construct shell commands without proper input neutralization. This allows an unauthenticated attacker to inject shell metacharacters into the command string, leading to arbitrary code execution via system calls.

The ability to execute arbitrary commands on a host system represents a total compromise of the affected node. This vulnerability is rated 9.8 (Critical) because it allows for unauthenticated remote code execution, which could lead to full system takeover, data exfiltration, or the disruption of critical mission operations that rely on the MOOS-IvP middleware.

Immediate Action: Update the MOOS-IvP software to a version beyond 24.8.1 that includes the necessary input sanitization patches. Users should consult the vendor GitHub repository for the specific commit or release containing the fix.

Proactive Monitoring: Monitor system logs for unexpected child processes spawned by the uMemWatch binary and audit the MOOS DB client list for suspicious or abnormally formatted client names.

Compensating Controls: Deploy host-based intrusion detection systems to alert on unauthorized shell command execution originating from the uMemWatch process and ensure the service runs with the least privilege necessary to limit the impact of a successful breach.

Public Exploit Available: No

Given the critical severity of this command injection flaw and the potential for full system compromise, organizations should prioritize patching their MOOS-IvP deployments immediately. Verify the integrity of the environment by checking for any unauthorized modifications or anomalous process activity that may have occurred prior to applying the update.