CVE-2026-32713: Dronecode PX4 Auth Bypass Vulnerability

CVE-2026-32713 Overview

CVE-2026-32713 is a logic error vulnerability in the PX4 Autopilot MAVLink FTP session validation that affects drone flight control systems. The vulnerability stems from incorrect boolean logic (&& instead of ||) in session validation checks, which allows BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This flaw enables an unauthenticated attacker within adjacent network range to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks.

Critical Impact

Unauthenticated attackers on adjacent networks can cause denial of service conditions in drone flight control systems by exploiting improper session validation in the MAVLink FTP protocol implementation.

Affected Products

• Dronecode PX4 Drone Autopilot versions prior to 1.17.0-rc2
• Dronecode PX4 Drone Autopilot 1.17.0-alpha1
• Dronecode PX4 Drone Autopilot 1.17.0-beta1
• Dronecode PX4 Drone Autopilot 1.17.0-rc1

Discovery Timeline

• 2026-03-16 - CVE-2026-32713 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32713

Vulnerability Analysis

This vulnerability is classified under CWE-670 (Always-Incorrect Control Flow Implementation), indicating a fundamental flaw in the program's control logic. The core issue lies in the MAVLink FTP session validation mechanism where the autopilot software incorrectly evaluates session validity conditions using a logical AND operator (&&) instead of the correct logical OR operator (||).

The attack requires adjacent network access, meaning an attacker must be within radio range or on the same local network segment as the vulnerable drone system. No user interaction or authentication is required to exploit this vulnerability, making it particularly concerning for autonomous drone operations.

The primary impact is availability-focused, as exploitation can lead to denial of service conditions affecting the drone's FTP subsystem. While confidentiality and integrity are not directly compromised, disrupting flight control system communications could have severe real-world consequences for drone operations.

Root Cause

The root cause is a boolean logic error in the FTP session validation code. When checking whether a session is valid before performing BurstReadFile or WriteFile operations, the code uses && (AND) to combine validation conditions when it should use || (OR). This means that certain invalid session states pass the validation check when they should be rejected.

This type of flaw is commonly introduced during complex conditional logic implementation where multiple validation conditions must be evaluated. The incorrect operator allows the code to proceed when only one condition fails instead of requiring all conditions to pass.

Attack Vector

An unauthenticated attacker positioned on an adjacent network can exploit this vulnerability by sending specially crafted MAVLink FTP requests that target the flawed session validation logic. The attack mechanism involves:

The attacker sends FTP operation requests (specifically BurstReadFile or WriteFile commands) that would normally be rejected due to invalid session state or closed file descriptors. Because of the incorrect boolean logic, these requests pass validation checks erroneously. This allows the attacker to trigger operations on invalid file descriptors, putting the FTP subsystem into an inconsistent state and potentially causing denial of service conditions.

The vulnerability exploitation does not require any prior authentication, making it accessible to any attacker within radio communication range of the affected drone system. For technical details and the specific code changes, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-32713

Indicators of Compromise

• Unexpected FTP session errors or subsystem crashes in PX4 Autopilot logs
• Anomalous MAVLink FTP requests from unknown sources on adjacent networks
• Multiple failed or malformed BurstReadFile or WriteFile operations in flight controller logs
• Drone communication disruptions coinciding with unusual network activity

Detection Strategies

• Monitor MAVLink protocol traffic for malformed or unexpected FTP command sequences
• Implement network segmentation monitoring to detect unauthorized adjacent network access attempts
• Review PX4 Autopilot system logs for FTP subsystem inconsistencies or unexpected state changes
• Deploy intrusion detection rules targeting known attack patterns against MAVLink FTP implementations

Monitoring Recommendations

• Enable verbose logging for the MAVLink FTP subsystem to capture session validation events
• Implement alerting for FTP operations that result in file descriptor errors or session state anomalies
• Monitor ground control station communications for signs of interference or unauthorized command injection
• Conduct regular security audits of drone communication channels and access control configurations

How to Mitigate CVE-2026-32713

Immediate Actions Required

• Upgrade PX4 Autopilot to version 1.17.0-rc2 or later immediately
• Review all deployed drone systems to identify instances running vulnerable firmware versions
• Implement network access controls to restrict adjacent network access to authorized devices only
• Consider temporarily grounding affected drones in high-security environments until patches are applied

Patch Information

The vulnerability is fixed in PX4 Autopilot version 1.17.0-rc2. The patch corrects the boolean logic error in the MAVLink FTP session validation code by replacing the incorrect && operator with the proper || operator. Organizations should update their drone firmware through official Dronecode channels. For complete patch details, see the GitHub Security Advisory.

Workarounds

• Restrict physical and network access to drone communication links to trusted personnel only
• Implement additional network-level filtering to block unauthorized MAVLink traffic
• Use encrypted communication channels where possible to reduce attack surface
• Monitor for unusual FTP activity and be prepared to manually intervene if anomalies are detected

# Verify PX4 Autopilot version to confirm patch status
# Connect to drone via MAVLink console and check version
# Example: Check firmware version via QGroundControl or MAVLink shell
px4_version
# Ensure version is 1.17.0-rc2 or later
# If running vulnerable version, update firmware immediately