CVE-2024-24254

MEDIUM

Dronecode Px4 Drone Autopilot < 1.14.0 - Race Condition

Title source: rule

Description

PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and mission_feasibility_checker.cpp. This will result in the drone uploading overlapping geofences and mission routes.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/Drone-Lab/PX4-Autopilot/blob/report-can-not-pause-vulnerability/Multi-Threaded%20Race%20Condition%20bug%20found%20in%20PX4%20cause%20drone%20can%20not%20PAUSE.md

View Exploit ZIP pw:eip

Product

https://github.com/PX4/PX4-Autopilot

Scores

CVSS v3 4.2

EPSS 0.0004

EPSS Percentile 11.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-362

Status published

Products (1)

dronecode/px4_drone_autopilot < 1.14.0

Published Feb 06, 2024

Tracked Since Feb 18, 2026