A critical remote code execution vulnerability in pAntler essential-moos allows unauthenticated attackers to execute arbitrary programs on the host system.

The vulnerability exists in the pAntler component, which fails to perform authentication or integrity checks on incoming MISSION_FILE messages received via the MOOSDB. An unauthenticated attacker can supply a malicious mission file containing arbitrary Run entries, which are subsequently parsed and executed by the application using the execvp() system call.

Successful exploitation of this vulnerability results in full remote code execution on the host machine. This grants an attacker the ability to compromise the integrity and confidentiality of the entire system, potentially leading to unauthorized data access, lateral movement within the network, or complete system takeover. With a CVSS score of 8.1, this flaw is categorized as high severity and poses a significant risk to organizational infrastructure.

Immediate Action: There is currently no official patch available for this vulnerability. Administrators should isolate MOOSDB instances from untrusted networks and ensure that access is restricted to authorized clients only using network-level controls.

Proactive Monitoring: Monitor system logs for unexpected child process creation or unauthorized execution attempts originating from the MOOSDB service. Review all incoming MISSION_FILE messages for suspicious Run entries that deviate from expected mission parameters.

Compensating Controls: Implement a strict firewall policy or an intrusion detection system (IDS) rule to block unauthorized traffic to the MOOSDB port (default 9000). Restricting network access to the service significantly reduces the attack surface for this unauthenticated flaw.

Public Exploit Available: No

Given the potential for full system compromise, this vulnerability must be treated with high urgency. Organizations utilizing pAntler essential-moos should prioritize network segmentation for all MOOSDB deployments until a vendor-supplied patch is released. Continuous monitoring of service communication remains the most effective method to detect potential exploitation attempts in the interim.