EUVD-2026-71790
GHSA-43c5-wgwh-x5c8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Shell access is adjacent (MAVLink/serial), no auth in PX4 shell (PR:N), single command triggers crash (AC:L), availability-only impact with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.
AnalysisAI
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Access to any PX4 interactive shell is required: this includes the MAVLink console (forwarded by QGroundControl or similar GCS over a telemetry link), a UART/USB serial console (physical proximity), or a companion-computer shell session with NSH access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N accurately captures the technical profile: adjacency requirement constrains exploitation to parties already holding shell access (MAVLink GCS, companion computer, USB tether, telemetry link), but within that access, exploitation is trivially simple - a single one-line command with no complex setup. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is confirmed in GitHub commit 02eabc08c9b8cb1de525070cacb7ea0c495136f6 and PR #28475 (https://github.com/PX4/PX4-Autopilot/pull/28475); a patched tagged release version is not independently confirmed from the available data - users should build from the fixed commit or monitor the PX4 release page for a formal patch release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PX4 systems in use and identify those running version 1.17.0 or earlier; assess exposure through MAVLink console access, serial UART/USB interfaces, and companion computer links. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Px4 Autopilot
View allStack overflow vulnerability in PX4 autopilot drone flight control software (versions prior to 1.17.0-rc2) where the Zen
Buffer overflow vulnerability in PX4 autopilot drone firmware versions before 1.17.0-rc2 that allows adjacent network at
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap
PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's
An unauthenticated path traversal vulnerability in PX4 Autopilot's MAVLink FTP implementation (CWE-22) allows any MAVLin
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface n
PX4 Autopilot versions prior to 1.17.0-rc1 contain a heap-use-after-free vulnerability in the MavlinkShell::available()
PX4 autopilot versions prior to 1.17.0-rc2 contain an unbounded memcpy vulnerability in the tattu_can module that allows
PX4 Autopilot prior to version 1.17.0-rc2 contains a boolean logic error in MAVLink FTP session validation that uses AND
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today