Home

Description

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

PUBLISHED Reserved 2026-01-28 | Published 2026-03-31 | Updated 2026-03-31 | Assigner icscert




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-306

Product status

Default status
unaffected

v1.16.0 SITL
affected

Credits

Dolev Aviv of Cyviation reported this vulnerability to CISA. finder

References

docs.px4.io/main/en/mavlink/security_hardening

docs.px4.io/main/en/mavlink/message_signing

www.cisa.gov/news-events/ics-advisories/icsa-26-090-02

github.com/...p/csaf_files/OT/white/2026/icsa-26-090-02.json

cve.org (CVE-2026-1579)

nvd.nist.gov (CVE-2026-1579)

Download JSON