Damn-Vulnerable-Drone

Damn Vulnerable Drone El Damn Vulnerable Drone es un simulador de hacking de drones intencionalmente vulnerable basado en la popular arquitectura ArduPilot/MAVLink, que proporciona un entorno realista para el hacking práctico de drones. Tabla de Contenidos Acerca del Damn Vulnerable Drone ¿Qué es...

CVE-2026-36522

CVE-2026-36522 Unauthenticated NaN Injection via MAVLinkPARAMSET in ArduPilot ArduPlane | ---|--- CVE| CVE-2026-36522 CWE| CWE-1287 Improper Validation of Specified Type of Input CVSS 3.1| 9.1 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected| ArduPilot ArduPlane 4.0.1 confirmed Component|...

CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler Stack Buffer Overflow DoS -orange -blue 📜 Description CVE-2026-32743 is a stack‑based buffer overflow in the MavlinkLogHandler of PX4 Autopilot versions ≤1.17.0-rc2. The LogEntry.filepath buffer is only 60 bytes , but sscanf parses log directory...

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743 CVE-2026-32743 — PX4 Autopilot Stack Buffer Overflow CTT-Enhanced: 33-Layer Temporal Cascade Drone DoS .The original exploit crashes the MAVLink task via a 60-byte overflow. The CTT version distributes the overflow across 33 temporal layers, each...

PX4-Military-UAV-Autopilot-1.12.3-Stack-Buffer-Overflow-Exploit-CVE-2025-5640-

PX4 Military UAV Autopilot =1.12.3 Stack Buffer Overflow Exploit CVE-2025-5640 Author: Mohammed Idrees Banyamer @banyamersecurity GitHub: https://github.com/mbanyamer Date: 2025-06-21 Tested on: Ubuntu 20.04 LTS + PX4 SITL jMAVSim CVE: CVE-2025-5640 Type: Denial of Service DoS via Stack Buffer...

CVE-2026-86713

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup deletes the LoadMon object and frees the performance counter before perfend attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop comma...

CVE-2026-86713 PX4 Autopilot through 1.17.0 Use-After-Free in load_mon

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup deletes the LoadMon object and frees the performance counter before perfend attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop comma...

EUVD-2026-72689

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the loadmon module's stop path where exitandcleanup deletes the LoadMon object and frees the performance counter before perfend attempts to access it. Attackers can trigger this vulnerability by issuing the loadmon stop comma...

PT-2026-55304

Name of the Vulnerable Software and Affected Versions ardupilot versions prior to Plane-4.6.4 Description An out-of-bounds read issue exists in the GCS MAVLINK::handle serial control function within the libraries/GCS MAVLink/GCS serial control.cpp file. An out-of-bounds read occurs when a program...

CVE-2026-38971

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...

CVE-2026-38971

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...

Exploit for Stack-based Buffer Overflow in Dronecode Px4_Drone_Autopilot

CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler Stack Buffer...

CVE-2026-1579

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

CVE-2026-1579

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

CVE-2026-1579

The CVE-2026-1579 issue affects PX4 Autopilot via the MAVLink protocol. Without MAVLink 2.0 message signing, unauthenticated entities with access to the MAVLink interface can send messages (including SERIAL_CONTROL, which can grant interactive shell access), potentially compromising devices that ...

CVE-2026-1579 PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

CVE-2026-1579 PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

CVE-2026-1579

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

PX4 Autopilot

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

PT-2026-29340

Name of the Vulnerable Software and Affected Versions PX4 Autopilot affected versions not specified Description The MAVLink communication protocol, as used by PX4 Autopilot, does not require cryptographic authentication by default. Without MAVLink 2.0 message signing enabled, unauthenticated...