PT-2026-29340 · Unknown · Px4-Autopilot

Dolev Aviv · Publicado 2026-03-31 · Atualizado 2026-04-15 · CVE-2026-1579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PX4 Autopilot (affected versions not specified)

Description The MAVLink communication protocol, as used by PX4 Autopilot, does not require cryptographic authentication by default. Without MAVLink 2.0 message signing enabled, unauthenticated parties with access to the MAVLink interface can send messages, including the SERIAL CONTROL message which provides interactive shell access. Enabling MAVLink 2.0 message signing in PX4 provides cryptographic authentication and rejects unsigned messages at the protocol level. The SERIAL CONTROL message allows for remote shell access.

Recommendations Enable MAVLink 2.0 message signing to provide cryptographic authentication for all MAVLink communication.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-1579

Produtos afetados

Px4-Autopilot

Referências · 17

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json · Nota
• https://twitter.com/syedaquib77/status/2039622527098462217 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2039372135009783884 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2039096059931083129 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/2039370955831841087 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1579 · Nota de Segurança
• https://twitter.com/ZeitTrender/status/2041332067934572635 · Publicação no Twitter
• https://docs.px4.io/main/en/mavlink/security_hardening · Nota
• https://twitter.com/threatcluster/status/2039651650864865659 · Publicação no Twitter
• https://twitter.com/aviatrixtrc/status/2039385334119579916 · Publicação no Twitter
• https://twitter.com/CosmicBytez/status/2039451437231747180 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2039076357657760179 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2039100859171123530 · Publicação no Twitter
• https://docs.px4.io/main/en/mavlink/message_signing · Nota
• https://twitter.com/SecurityAr58409/status/2044263007555895396 · Publicação no Twitter