A critical buffer overflow vulnerability in MOOS ui-moos allows unauthenticated attackers to achieve remote code execution by supplying maliciously crafted identifiers.

The software utilizes the unsafe sprintf function to format client and variable names into fixed 1024-byte buffers without performing necessary length validation. This memory corruption flaw can be triggered when an operator interacts with the process list or pokes variables, allowing an attacker to overwrite adjacent memory and execute arbitrary code.

Successful exploitation of this vulnerability poses a severe risk to organizational assets, as it enables remote code execution with the privileges of the affected MOOS process. Given the CVSS score of 8.8, this flaw represents a high-risk entry point that could lead to complete system compromise, unauthorized data access, and significant operational disruption within robotics or research environments utilizing the MOOS framework.

Immediate Action: Monitor vendor communication channels for the release of an official security patch and apply it immediately upon availability.

Proactive Monitoring: Review system and application logs for anomalous process behavior or unexpected crashes during interactions with the ui-moos interface.

Compensating Controls: Implement network-level segmentation to restrict access to the MOOSDB service and utilize host-based intrusion detection systems to monitor for memory corruption patterns.

Public Exploit Available: Unknown

The severity of this remote code execution vulnerability necessitates immediate attention from security teams. Because the vulnerability involves standard library functions like sprintf without length checks, it is a classic memory safety issue that is highly susceptible to exploitation. Organizations should prioritize updating the software as soon as a fix is released and ensure that the ui-moos interface is not exposed to untrusted networks.