Executive brief
The PX4 Autopilot system, used in drones and unmanned vehicles, uses a communication protocol that does not require authentication by default. This allows an unauthorized person with network access to the vehicle to send commands, including those that provide full shell access to the system. An attacker could take control of the vehicle, access sensitive data, or disrupt operations.
Technical details
The MAVLink communication protocol used in PX4 Autopilot lacks mandatory cryptographic authentication by default (CWE-306). When MAVLink 2.0 message signing is disabled, an unauthenticated attacker with access to the MAVLink interface can inject arbitrary messages. This includes the SERIAL_CONTROL message, which provides interactive shell access to the autopilot system. To mitigate this, users must enable MAVLink 2.0 message signing, which causes the protocol to reject all unsigned messages. The vulnerability is confirmed in PX4 Autopilot v1.16.0 SITL.
Affected products
- PX4 Autopilot v1.16.0 SITL
Timeline
- 2026-03-31: advisory: Initial advisory published by ICS-CERT/NVD