CVE-2023-47625 - CVE House

Back to Database

Status published Low CVE-2023-47625

Global Buffer Overflow leading to denial of service in PX4-Autopilot

2.9 CVSS

Vulnerability Description

PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47625

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from PX4

View All →

PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after free

PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow

PX4-Autopilot Heap Buffer Overflow Bug

RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication

Affected Vendor

PX4

View all reports →

Affected Software

PX4-Autopilot

Vulnerable Versions:

< 1.14.0

Timeline

Official Publish: November 13th, 2023

Last Modified: September 3rd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control