PX4-Autopilot

산업계가 기반으로 삼는 자동조종 스택. 소개 PX4는 드론 및 무인 차량을 위한 오픈소스 자동조종 스택입니다. 멀티로터, 고정익, VTOL, 로버, 그리고 레이싱 쿼드부터 산업용 측량 항공기까지 다양한 실험 플랫폼을 지원합니다. NuttX, Linux, macOS에서 실행됩니다. BSD 3-Clause 라이선스로 배포됩니다. PX4를 선택해야 하는 이유 모듈식 아키텍처. PX4는 DDS 호환 발행/구독 미들웨어인 uORB를 기반으로 구축되었습니다. 모듈은 완전히 병렬화되어 있으며 스레드 안전성을 갖춥니다. 사용자 정의 구성을...

CVE-2026-32743-PX4-Autopilot-MavlinkLogHandler-Stack-Buffer-Overflow-DoS-

CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler 스택 버퍼 오버플로우 DoS -orange -blue 📜 설명 CVE-2026-32743 은 PX4 Autopilot ≤1.17.0-rc2 버전의 MavlinkLogHandler에서 발생하는 스택 기반 버퍼 오버플로우 입니다. LogEntry.filepath 버퍼는 60바이트 에 불과하지만, sscanf는 폭 지정자width specifier 없이 로그 디렉터리 경로를 파싱합니다. MAVLink 링크 접근 권한 을 가진 공격자는 다음을 수행...

CVE-2026-32707-PX4-Autopilot-tattu_can-Stack-Buffer-Overflow-DoS-

-orange CVE-2026-32707 - PX4-Autopilot tattucan 스택 버퍼 오버플로우 DoS root@kitploit: ╔════════════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗ ║ ║ ██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗...

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743 CVE-2026-32743 — PX4 오토파일럿 스택 버퍼 오버플로우 CTT-Enhanced: 33계층 시간적 캐스케이드 드론 DoS. 원본 익스플로잇은 60바이트 오버플로우를 통해 MAVLink 태스크를 충돌시킵니다. CTT 버전은 오버플로우를 33개의 시간적 계층에 분산시키며, 각 계층은 위상 공진 타이밍과 시간적 웨지 필터링을 사용합니다. 결과: 지속적 DoS. 패치 불가능. CTT-Enhanced PX4 오토파일럿 익스플로잇 —...

CVE-2026-84698 PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size

PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...

EUVD-2026-69789

PX4 Autopilot contains a heap buffer overflow vulnerability in the sdbench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sdbench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the syst...

CVE-2026-84698

PX4 Autopilot is affected by a heap buffer overflow in the sd_bench command. The command writes a four-byte block number into a user-supplied sized allocation; invoking it with a block size below four bytes overflows the buffer, potentially allowing arbitrary code execution or a system crash . Th...

PX4-Military-UAV-Autopilot-1.12.3-Stack-Buffer-Overflow-Exploit-CVE-2025-5640-

PX4 軍事用UAVオートパイロット =1.12.3 スタックバッファオーバーフローエクスプロイト CVE-2025-5640 著者: Mohammed Idrees Banyamer @banyamersecurity GitHub: https://github.com/mbanyamer 日付: 2025-06-21 テスト環境: Ubuntu 20.04 LTS + PX4 SITL jMAVSim CVE: CVE-2025-5640 タイプ: スタックバッファオーバーフローによるサービス拒否 DoS プラットフォーム: クロスプラットフォーム 軍事用UAV / PX4 SIT...

Exploit for Stack-based Buffer Overflow in Dronecode Px4_Drone_Autopilot

CTT-Enhanced-PX4-Autopilot-Exploit-CVE-2026-32743 CVE-2026-327...

Exploit for Stack-based Buffer Overflow in Dronecode Px4_Drone_Autopilot

CVE-2026-32743 - PX4 Autopilot MavlinkLogHandler Stack Buffer...

CVE-2026-1579

The CVE-2026-1579 issue affects PX4 Autopilot via the MAVLink protocol. Without MAVLink 2.0 message signing, unauthenticated entities with access to the MAVLink interface can send messages (including SERIAL_CONTROL, which can grant interactive shell access), potentially compromising devices that ...

CVE-2026-1579 PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

CVE-2026-1579 PX4 Autopilot Missing authentication for critical function

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIALCONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink...

PX4-Autopilot 访问控制错误漏洞

PX4-Autopilot is an open-source drone autopilot system developed by PX4. PX4-Autopilot has a security vulnerability related to access control. This vulnerability arises from the fact that encryption authentication is not required by default, and when MAVLink 2.0 message signing is not enabled, an...

CVE-2026-32709

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem withou...

CVE-2026-32705

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the BST telemetry probe writes a string terminator using a device-provided length without bounds. A malicious BST device can report an oversized devnamelen, causing a stack overflow in the driver and crashing the task or...

CVE-2026-32707

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattucan contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattucan is enabled and running, a CAN-injection-capable...

CVE-2026-32713

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic && instead of ||, allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors...

CVE-2026-32724

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available function. The issue is caused by a race condition between the MAVLink receiver thread which handles shell creation/destruction and the telemetry sender thre...

CVE-2026-32743

PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions 1.17.0-rc2 and below are vulnerable to Stack-based Buffer Overflow through the MavlinkLogHandler, and are triggered via MAVLink log request. The LogEntry.filepath buffer is 60 bytes, but the sscanf function parses...