CVE-2026-85439highCWE-78

CVE-2026-85439: falha de alta gravidade em moos-ivp

MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar moos-ivp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.5%
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
moos-ivp · moos-ivp
CVEs relacionadas — moos-ivp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-85425CRITICALMOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOSEPSS 1.8%CVE-2026-85437CRITICALMOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String DecodersEPSS 1.4%CVE-2026-85438CRITICALMOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload CountsEPSS 1.1%CVE-2026-85426CRITICALMOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client NamesEPSS 0.9%CVE-2026-85449HIGHMOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORTEPSS 0.9%CVE-2026-85448HIGHMOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State RetentionEPSS 0.8%