Px4
Monthly
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap memory by issuing a single `load_mon stop` command over a MAVLink or PXH shell. The bug in `exit_and_cleanup()` frees the LoadMon object and its performance counter before `perf_end()` consumes it, producing a dangling-pointer dereference that corrupts heap objects and destabilizes the autopilot flight stack - in a UAV context, a plausible pathway to loss of vehicle control mid-flight. An upstream fix has been merged as PR #28544; no public exploit code is identified and the CVE is not listed in CISA KEV.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Unauthenticated remote code execution in PX4 Autopilot via MAVLink protocol allows network attackers to execute arbitrary commands through SERIAL_CONTROL messages when message signing is disabled. The MAVLink 2.0 protocol in PX4 accepts unsigned messages by default, enabling any party with network access to the MAVLink interface to send interactive shell commands without cryptographic authentication. EPSS data not provided; no KEV status confirmed; reported by ICS-CERT indicating potential operational technology impact.
Stack overflow vulnerability in PX4 autopilot drone flight control software (versions prior to 1.17.0-rc2) where the Zenoh uORB subscriber fails to validate incoming payload sizes, allowing remote attackers to crash the Zenoh bridge task. No active exploitation (not in KEV), no known POC, and the local attack vector (CVSS AV:L) limits real-world impact despite the high 7.8 CVSS score.
Buffer overflow vulnerability in PX4 autopilot drone firmware versions before 1.17.0-rc2 that allows adjacent network attackers to crash the system by sending oversized CRSF packets. The vulnerability requires the CRSF receiver protocol to be enabled on a serial port and can cause memory corruption leading to denial of service. No active exploitation (not in KEV) or public POC has been reported.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's heap by racing task spawning against object deletion in the temperature calibration subsystem. The root cause is that `TemperatureCalibration::start()` stores the spawned task handle in an instance member variable; if the object is freed before the spawned task begins execution, the task writes into dangling heap memory, corrupting adjacent allocator metadata or unrelated objects. The upstream fix in PR #28487 promotes the task handle to a local variable, eliminating the lifecycle coupling. No public exploit code or CISA KEV listing exists at time of analysis.
PX4 Autopilot versions prior to 1.17.0-rc1 contain a heap-use-after-free vulnerability in the MavlinkShell::available() function caused by a race condition between the MAVLink receiver and telemetry sender threads. Remote attackers can trigger this vulnerability by sending crafted SERIAL_CONTROL messages (ID 126) via MAVLink, leading to denial of service of the flight control system. The vulnerability affects drone operators and systems accepting MAVLink telemetry from untrusted ground stations or networks.
PX4 Autopilot prior to version 1.17.0-rc2 contains a boolean logic error in MAVLink FTP session validation that uses AND (&&) instead of OR (||) operators, allowing attackers to bypass session isolation checks and execute file operations on invalid or closed file descriptors. An unauthenticated attacker on the adjacent network can exploit this vulnerability to destabilize the FTP subsystem, trigger denial-of-service conditions through invalid file descriptor operations, and potentially compromise the integrity of drone flight control systems. While the CVSS score of 4.3 indicates low to moderate severity with availability impact, the safety-critical nature of autopilot systems and the unauthenticated attack vector warrant immediate attention.
An unauthenticated path traversal vulnerability in PX4 Autopilot's MAVLink FTP implementation (CWE-22) allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on flight controller filesystems without authentication or privilege requirements. Affected versions are prior to 1.17.0-rc2, impacting both NuttX-based flight controllers and POSIX targets (Linux companion computers and SITL simulation environments). Attackers with network access to MAVLink communication channels can exploit this vulnerability to compromise flight controller integrity, extract sensitive configuration data, or inject malicious firmware.
PX4 autopilot versions prior to 1.17.0-rc2 contain an unbounded memcpy vulnerability in the tattu_can module that allows stack memory corruption when processing specially crafted CAN frames. An attacker with CAN bus injection capability can trigger denial of service or memory corruption in drone systems where tattu_can is enabled, potentially compromising flight safety and system stability.
PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that allows a malicious BST device to trigger a buffer overflow by reporting an oversized dev_name_len parameter without bounds checking. An attacker with physical access to inject a malicious BST device can crash the autopilot task or potentially achieve arbitrary code execution, impacting drone flight safety and control systems. No active KEV exploitation data or public POC is currently documented, but the vulnerability is patched in version 1.17.0-rc2.
Use-after-free in PX4 Autopilot through 1.17.0 allows an adjacent unauthenticated attacker to corrupt flight-stack heap memory by issuing a single `load_mon stop` command over a MAVLink or PXH shell. The bug in `exit_and_cleanup()` frees the LoadMon object and its performance counter before `perf_end()` consumes it, producing a dangling-pointer dereference that corrupts heap objects and destabilizes the autopilot flight stack - in a UAV context, a plausible pathway to loss of vehicle control mid-flight. An upstream fix has been merged as PR #28544; no public exploit code is identified and the CVE is not listed in CISA KEV.
Null pointer dereference in PX4 Autopilot through 1.17.0 allows any party with PX4 shell access to crash the autopilot process by issuing 'param select' or 'param select-backup' with no path argument, triggering a dereference of a null filename pointer passed to strcmp() inside param_set_default_file() and param_set_backup_file(). The CVSS 4.0 vector (AV:A) confirms the shell must be reachable via an adjacent vector - MAVLink console, UART/USB serial, or companion-computer link - with no authentication required within the shell environment itself. In airborne or safety-critical deployments, a process crash during flight could have consequences beyond mere software unavailability. No public exploit code identified at time of analysis; the fix is confirmed in upstream PR #28475.
Unauthenticated remote code execution in PX4 Autopilot via MAVLink protocol allows network attackers to execute arbitrary commands through SERIAL_CONTROL messages when message signing is disabled. The MAVLink 2.0 protocol in PX4 accepts unsigned messages by default, enabling any party with network access to the MAVLink interface to send interactive shell commands without cryptographic authentication. EPSS data not provided; no KEV status confirmed; reported by ICS-CERT indicating potential operational technology impact.
Stack overflow vulnerability in PX4 autopilot drone flight control software (versions prior to 1.17.0-rc2) where the Zenoh uORB subscriber fails to validate incoming payload sizes, allowing remote attackers to crash the Zenoh bridge task. No active exploitation (not in KEV), no known POC, and the local attack vector (CVSS AV:L) limits real-world impact despite the high 7.8 CVSS score.
Buffer overflow vulnerability in PX4 autopilot drone firmware versions before 1.17.0-rc2 that allows adjacent network attackers to crash the system by sending oversized CRSF packets. The vulnerability requires the CRSF receiver protocol to be enabled on a serial port and can cause memory corruption leading to denial of service. No active exploitation (not in KEV) or public POC has been reported.
Stack buffer over-read in PX4 Autopilot through v1.17.0 exposes stack memory via the netman system command's interface name handling. Supplying an interface name of 74 bytes or more via the -i option bypasses missing length validation, causing reads beyond allocated buffer boundaries; the over-read data leaks to console output and may also be written into persistent network configuration files, risking both information disclosure and config corruption across reboots. No public exploit or active exploitation has been identified, but the upstream fix is available as a merged GitHub PR and commit.
Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's heap by racing task spawning against object deletion in the temperature calibration subsystem. The root cause is that `TemperatureCalibration::start()` stores the spawned task handle in an instance member variable; if the object is freed before the spawned task begins execution, the task writes into dangling heap memory, corrupting adjacent allocator metadata or unrelated objects. The upstream fix in PR #28487 promotes the task handle to a local variable, eliminating the lifecycle coupling. No public exploit code or CISA KEV listing exists at time of analysis.
PX4 Autopilot versions prior to 1.17.0-rc1 contain a heap-use-after-free vulnerability in the MavlinkShell::available() function caused by a race condition between the MAVLink receiver and telemetry sender threads. Remote attackers can trigger this vulnerability by sending crafted SERIAL_CONTROL messages (ID 126) via MAVLink, leading to denial of service of the flight control system. The vulnerability affects drone operators and systems accepting MAVLink telemetry from untrusted ground stations or networks.
PX4 Autopilot prior to version 1.17.0-rc2 contains a boolean logic error in MAVLink FTP session validation that uses AND (&&) instead of OR (||) operators, allowing attackers to bypass session isolation checks and execute file operations on invalid or closed file descriptors. An unauthenticated attacker on the adjacent network can exploit this vulnerability to destabilize the FTP subsystem, trigger denial-of-service conditions through invalid file descriptor operations, and potentially compromise the integrity of drone flight control systems. While the CVSS score of 4.3 indicates low to moderate severity with availability impact, the safety-critical nature of autopilot systems and the unauthenticated attack vector warrant immediate attention.
An unauthenticated path traversal vulnerability in PX4 Autopilot's MAVLink FTP implementation (CWE-22) allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on flight controller filesystems without authentication or privilege requirements. Affected versions are prior to 1.17.0-rc2, impacting both NuttX-based flight controllers and POSIX targets (Linux companion computers and SITL simulation environments). Attackers with network access to MAVLink communication channels can exploit this vulnerability to compromise flight controller integrity, extract sensitive configuration data, or inject malicious firmware.
PX4 autopilot versions prior to 1.17.0-rc2 contain an unbounded memcpy vulnerability in the tattu_can module that allows stack memory corruption when processing specially crafted CAN frames. An attacker with CAN bus injection capability can trigger denial of service or memory corruption in drone systems where tattu_can is enabled, potentially compromising flight safety and system stability.
PX4 autopilot versions prior to 1.17.0-rc2 contain a stack overflow vulnerability in the BST telemetry probe driver that allows a malicious BST device to trigger a buffer overflow by reporting an oversized dev_name_len parameter without bounds checking. An attacker with physical access to inject a malicious BST device can crash the autopilot task or potentially achieve arbitrary code execution, impacting drone flight safety and control systems. No active KEV exploitation data or public POC is currently documented, but the vulnerability is patched in version 1.17.0-rc2.