2 lines
4.5 KiB
JSON
2 lines
4.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Autopilot","vendor":"PX4","versions":[{"status":"affected","version":"v1.16.0 SITL"}]}],"source":"ics-cert@hq.dhs.gov"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:px4:autopilot:1.16.0:-:*:*:*:*:*:*","matchCriteriaId":"03F7087C-BED0-41D3-83A8-75FA8B7DB38F","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level."},{"lang":"es","value":"El protocolo de comunicación MAVLink no requiere autenticación criptográfica por defecto. Cuando la firma de mensajes MAVLink 2.0 no está habilitada, cualquier mensaje -- incluyendo SERIAL_CONTROL, que proporciona acceso interactivo a la shell -- puede ser enviado por una parte no autenticada con acceso a la interfaz MAVLink. PX4 proporciona la firma de mensajes MAVLink 2.0 como el mecanismo de autenticación criptográfica para toda la comunicación MAVLink. Cuando la firma está habilitada, los mensajes no firmados son rechazados a nivel de protocolo."}],"id":"CVE-2026-1579","lastModified":"2026-07-29T19:31:46.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1579","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-31T20:35:56.040324Z","version":"2.0.3"}}]},"published":"2026-03-31T21:16:27.897","references":[{"source":"ics-cert@hq.dhs.gov","tags":["Product"],"url":"https://docs.px4.io/main/en/mavlink/message_signing"},{"source":"ics-cert@hq.dhs.gov","tags":["Product"],"url":"https://docs.px4.io/main/en/mavlink/security_hardening"},{"source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory"],"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"},{"source":"ics-cert@hq.dhs.gov","tags":["Third Party Advisory","US Government Resource"],"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
|