PT-2026-25395 · Px4+2 · Px4-Autopilot+1

Dxleryt · Publicado 2026-03-13 · Atualizado 2026-03-16 · CVE-2026-32713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PX4 autopilot versions prior to 1.17.0-rc2

Description A logic error exists in the PX4 Autopilot MAVLink FTP session validation. The validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This allows an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. The vulnerable component is the MAVLink FTP session validation logic.

Recommendations Update to version 1.17.0-rc2 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-670

Identificadores relacionados

CVE-2026-32713

GHSA-PP2C-JR5G-6F2M

Produtos afetados

Px4-Autopilot

Px4 Drone Autopilot

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32713.json · Exploit
• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2032605821545205944 · Publicação no Twitter
• https://t.me/CVEtracker/47389 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-32713 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32713 · Nota de Segurança