The MAVLink communication protocol does not enforce cryptographic authentication unless MAVLink 2.0 message signing is activated. When signing is disabled, any party that can reach the interface can send unsigned messages, including the SERIAL_CONTROL command which grants a shell on the PX4 autopilot. This allows an attacker to execute arbitrary commands, effectively taking control of the flight controller and compromising the vehicle’s confidentiality, integrity, and availability.

All installations of PX4 Autopilot, specifically firmware version 1.16.0 as identified by the CPE string, are affected. Users who have not enabled MAVLink 2.0 message signing on any non‑USB communication link are exposed to this risk.

The CVSS score of 9.3 reflects a severe vulnerability. The low EPSS score (<1%) suggests that widespread exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. The most plausible attack vector involves any unauthorized access to the MAVLink interface, such as over wireless telemetry or ground‑station connections, where an attacker can inject the unsigned messages that the autopilot will accept.