Moos essential‑moos through version 10.0.1 contains an unauthenticated vulnerability in the pMOOSBridge component when it is configured with UDPListen. Attackers can send crafted UDP packets to the listening port. The packets are accepted without authentication, allowing the injection of arbitrary variables into the local MOOS community with spoofed source and community identifiers. This behavior is a classic example of the weaknesses described in CWE‑345.

The affected product is themoos:essential‑moos up to and including version 10.0.1. No other vendors or product versions are listed in the CNA data.

The CVSS score is 8.7, indicating high severity. EPSS score is 2%, indicating a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits have been reported yet. The attack vector is remote over UDP; the prerequisite is that the pMOOSBridge is configured to listen for UDP traffic. Once an attacker floods the port with crafted packets, they can inject malicious variables that other components in the MOOS community will accept, potentially leading to unauthorized behavior or data manipulation.