PX4 Autopilot’s MAVLink FTP session validation implements incorrect boolean logic, allowing BurstReadFile and WriteFile operations to execute with invalid or closed file descriptors. An unauthenticated attacker can exploit this flaw to place the FTP subsystem into an inconsistent state, bypassing session isolation checks. This may lead to unexpected behavior, data corruption, or system crash, impacting integrity and availability of the autopilot software.

The vulnerability affects the PX4 Autopilot firmware, specifically all releases prior to 1.17.0-rc2. This includes the alpha1, beta1, and rc1 variants of version 1.17.0, as well as any earlier releases that contain the same logic error.

The CVSS score is 4.3, indicating moderate risk, and the EPSS score is below 1%, suggesting low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to send MAVLink FTP commands to the flight stack, which is typically available to any entity that can communicate with the drone’s network interface. No authentication is required, so the attack is feasible in a wide range of operational environments.