PT-2024-23617 · Unknown · Px4-Autopilot

Czbxzm · Published 2024-04-23 · Updated 2024-08-01 · CVE-2024-30800

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions PX4 Autopilot version 1.14

Description The issue allows an attacker to fly a drone into no-fly zones by breaching the geofence using flaws in the function. This can be achieved by exploiting the flaws in the geofence function of the PX4 Autopilot.

Recommendations For PX4 Autopilot version 1.14, consider disabling the geofence function until a patch is available to prevent attackers from breaching no-fly zones. Restrict access to the drone's navigation system to minimize the risk of exploitation. Avoid using the drone in areas with restricted airspace until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-229

Related Identifiers

CVE-2024-30800

Affected Products

Px4-Autopilot

References · 8

• https://github.com/PX4/PX4-Autopilot/pull/22394 · Patch
• https://github.com/PX4/PX4-Autopilot/issues/22282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30800 · Security Note
• https://t.me/cvenotify/77765 · Telegram Post
• https://t.me/cvenotify/77907 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1782779279438147811 · Twitter Post
• https://twitter.com/CVEnew/status/1782754243159408662 · Twitter Post