LC-2 · Software Danger Reports

LrrK Kinematic Software Danger Report

# LrrK Kinematic Software Danger Report

**LRRK Watch / Software Assurance** — Special filing: ten-year precedent, control-link trust.

| Field | Value |
| --- | --- |
| Collection cutoff | 19 August 2026 |
| Platform | Quiet Systems |
| Series | DKSR-R-01 · Control link (2016–2026) |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Retrospective special, not the daily 48-hour watch. Image rights require separate verification before publication. |

## Executive read

### BLUF

The decade’s control-link pattern is not a new radio chip. It is a default: whoever can speak on the bearer owns the vehicle, and turning on optional signing did not close that path.

### Key judgments

1. **[Assessment — High confidence]** Unauthenticated C2 is a protocol property of MAVLink v1 and of default-unsigned MAVLink 2, not a one-off vendor bug.
2. **[Assessment — High confidence]** Optional signing is not a Passport. The 2020 downgrade CVE, the 2020–2026 GPS-time argument, and the 2026 CISA PX4 advisory all treat “signing exists” as insufficient evidence that the link is authenticated.
3. **[Inference — Moderate confidence]** Hobby FPV links (ExpressLRS) and open autopilot stacks will keep sharing this failure class until signing is on by default and v1 is refused.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. Kwon 2018, then CVE-2020-10282: MAVLink v1 has no authentication

*Event / publication dates: Kwon et al., IEEE Access, 2018 (secondary indexes give 6 August 2018); NVD CVE-2020-10282 published 3 July 2020; Alias RVD#3316 filed 30 June 2020.*

| Field | Value |
| --- | --- |
| Component | dependency |
| Product | Dronecode MAVLink 1.0 as used by PX4 / ArduPilot GCS-controlled UAVs |
| CVE / advisory | CVE-2020-10282 (CNA: Alias Robotics). Kwon 2018 has no CVE. |
| Patch | none at protocol level; mitigation is MAVLink 2 signing, enforced |
| Exploit status | public writeup (2018); catalogued (2020). RVD: exploitation “not available.” Not KEV. |
| Taxonomy | CWE-306 (NVD) · CAPEC-272 · ATT&CK ICS T1692.001 (T0855) · OWASP IoT I2 · EMB3D TID-406 |

**Verified record — [Fact — A1]** Kwon, Yu, Cho, Eun and Park published an empirical study that MAVLink’s design gives any on-link peer command acceptance, including stopping an in-progress UAV mission (IEEE Access vol. 6, pp. 43203–43212, DOI 10.1109/ACCESS.2018.2863237). On 3 July 2020 NVD published CVE-2020-10282: MAVLink v1.0 missing authentication for a critical function (CWE-306). Alias Robotics filed RVD#3316 on 30 June 2020. ArduPilot maintainers argued in that thread that this is a documented design choice, not a defect.

**Exposure.** Any bearer that carries unsigned MAVLink (SiK, UDP, serial) can change Move and Act if a peer can speak on it.

**Intelligence assessment.** [Assessment — High confidence] The 2018 paper is the in-window citation that later C2 work sits on. [Assessment — High confidence] CVE-2020-10282 is the first formal ID for that property. [Uncertainty] Whether a given 2026 build still accepts unsigned v1 is an implementation question, not settled by the CVE text.

**Opportunity.** Passport the link as “unsigned by default” vs “signing required and v1 refused.” Lab a signing-on / v1-refused configuration. Do not treat “MAVLink 2 available” as evidence.

**LRRK relevance.** Control Fabric. A KAT path from radio to autopilot command handler. Watch for CISA/ICS repeats of the same theory.

**Confidence.** High on the paper, the CVE, and the design property. Medium on the exact Kwon calendar day (secondary indexes).

## 02. CVE-2020-10283: signed MAVLink can still fall back to v1

*Event / publication dates: NVD published 20 August 2020.*

| Field | Value |
| --- | --- |
| Component | dependency |
| Product | MAVLink 2.0 / PX4 (Alias also discusses ArduPilot) |
| CVE / advisory | CVE-2020-10283 |
| Patch | none as a protocol RFC; mitigation is refuse v1 / require signing |
| Exploit status | catalogued. Researcher claimed a PX4 PoC in discussion; no public artifact independently reviewed here. Not KEV. |
| Taxonomy | CWE-288 (CNA) · CAPEC-620 · ATT&CK ICS T1692.001 (T0855) · OWASP IoT I2 · EMB3D TID-406 |

**Verified record — [Fact — A1]** NVD CVE-2020-10283 states that MAVLink 2.0 version negotiation can fall back to unauthenticated v1. Alias discussion of RVD#3316 pointed at `AUTOPILOT_VERSION` negotiation. ArduPilot’s khancyr disputed applicability.

**Exposure.** A vehicle that “has signing on” can still accept an unauthenticated peer if v1 is negotiable. That is a Control Fabric hole, not a missing feature.

**Intelligence assessment.** [Assessment — High confidence] This is the first CVE that breaks the signed-link assumption. [Uncertainty] Whether a current PX4 or ArduPilot build still accepts the downgrade was not independently re-tested for this filing. [Inference — Moderate confidence] Any Passport that only records “MAVLink 2 signing enabled” is incomplete without “v1 refused.”

**Opportunity.** Evidence that the handshake refuses v1. Kestrel across PX4 and ArduPilot builds for the same negotiation.

**LRRK relevance.** Control Fabric and Passport. Lab the handshake, not the HMAC.

**Confidence.** High on CVE text. Medium / unverified on current-build applicability.

## 03. ExpressLRS 1.x/2.x: binding phrase is not authentication

*Event / publication dates: NCC Group technical advisory 30 June 2022 (contact December 2021).*

| Field | Value |
| --- | --- |
| Component | firmware |
| Product | ExpressLRS 1.x and 2.x, 900 MHz and 2.4 GHz |
| CVE / advisory | no CVE. NCC Group technical advisory (Appleby). |
| Patch | partial. NCC PRs rejected 5 March 2022. Independent 2026 analysis (Koeck): 3.x hashes the UID on air; payload remains unauthenticated/unencrypted. |
| Exploit status | public writeup / advisory-only. No KEV. No in-wild claim found. |
| Taxonomy | CAPEC-115 · ATT&CK ICS T0860 · T1692.001 (T0855) · OWASP IoT I1 · I2 · EMB3D TID-406 |

**Verified record — [Fact — A1/B2]** NCC Group published that ExpressLRS 1.x/2.x leaked the binding-phrase UID in sync packets, allowing link takeover with stock hardware. Maintainers rejected the proposed PRs. Later public analysis describes a 3.x hash of the UID, closing the passive UID-on-air path, not authenticating the payload.

**Exposure.** Mass-market FPV control. Impact stated by NCC: full control or likely crash of an airborne craft. This is Move/Act on hobby and some dual-use airframes.

**Intelligence assessment.** [Assessment — High confidence] First named-firm advisory that a hobby “binding phrase” is anti-collision, not a security boundary. [Uncertainty] Treat 3.x as a partial protocol change, not a CVE patch. [Inference — Moderate confidence] The same class will recur on other phrase-bound RC links.

**Opportunity.** Passport ExpressLRS major version and whether the payload is authenticated. Watch 3.x claims that “UID hash” equals security.

**LRRK relevance.** Control Fabric. Sense-Move-Act on FPV. Lab the binding-vs-auth distinction.

**Confidence.** High on 1.x/2.x. Medium on 3.x as a complete fix.

## 04. ICSA-26-090-02 / CVE-2026-1579: unsigned MAVLink is a NuttX shell

*Event / publication dates: 31 March 2026.*

| Field | Value |
| --- | --- |
| Component | software |
| Product | PX4 Autopilot v1.16.0_SITL_latest_stable (CISA product string) |
| CVE / advisory | CVE-2026-1579; ICSA-26-090-02. Reporter: Dolev Aviv, Cyviation. |
| Patch | partial. Enable MAVLink 2.0 signing on non-USB links; PX4 hardening guide. Not described as a version that removes default-off signing. |
| Exploit status | advisory-only. CISA: no known public exploitation specifically targeting this. Not KEV. |
| Taxonomy | CWE-306 (CISA) · CAPEC-272 · ATT&CK ICS T1692.001 (T0855) · OWASP IoT I2 · EMB3D TID-406 |

**Verified record — [Fact — A1]** CISA ICSA-26-090-02 (31 March 2026) says PX4 Autopilot missing authentication on `SERIAL_CONTROL` allows an unauthenticated shell. Sectors listed: Transportation, Emergency Services, Defense Industrial Base. HQ listed as Switzerland. Mitigation: MAVLink 2 signing on non-USB links; PX4 “MAVLink Security Hardening” and message-signing docs. CISA names the stack, not Auterion or Holybro SKUs.

**Exposure.** Interactive shell on the flight controller is Act with persistence, not a mode change.

**Intelligence assessment.** [Assessment — High confidence] First CISA ICS advisory that treats a widely fielded open autopilot as OT and names missing link authentication as the failure. [Assessment — High confidence] Same design fact as Kwon / CVE-2020-10282, now inventory. [Uncertainty] The affected-version pin to one SITL string is oddly narrow for a protocol-default issue.

**Opportunity.** Campaign unsigned PX4/Auterion/Holybro ports as one class. Passport “signing required” with evidence, not a checkbox.

**LRRK relevance.** Control Fabric, Watch, Lab. Kestrel across integrators that ship unsigned MAVLink.

**Confidence.** High on the advisory. Moderate on which commercial SKUs match the SITL-tagged build.

## 05. GPS time vs MAVLink 2 signing (2020 issue, 2026 journal)

*Event / publication dates: ArduPilot issue #13860, 22–26 March 2020; IEEE Transactions on Communications vol. 74 pp. 2564–2579, 2026 (DOI 10.1109/TCOMM.2025.3644474).*

| Field | Value |
| --- | --- |
| Component | dependency |
| Product | MAVLink 2 signing on ArduPilot (issue: Copter 3.5.5 / Pixhawk1 / 3DR IRIS+; authors also say master). Journal: sim + HITL + hardware. |
| CVE / advisory | no CVE |
| Patch | none as a protocol redesign. 2020 thread closed as applying only after storage reset / before a real GPS time. Journal proposes countermeasures; not a stock CVE fix. |
| Exploit status | public writeup (issue + journal). Not KEV. |
| Taxonomy | CWE-345 (class, time source) · CAPEC-148 · OWASP IoT I7 |

**Verified record — [Fact — A1/B2]** ArduPilot #13860 (22 March 2020) described timestamp-manipulation against MAVLink 2 signing when GPS time can move the anti-replay clock. Maintainers (tridge, peterbarker) said timestamps only go forward and persist in `hal.storage`. Colton, Oracevic and Dilek (IEEE TComm 2026) published a journal treatment claiming a generalisable GPS-time attack against signing, with sim, HITL and hardware.

**Exposure.** Signing that binds anti-replay to spoofable civil GPS time fails without the secret key. That is Sense (GNSS) collapsing Control Fabric.

**Intelligence assessment.** [Assessment — High confidence] Both the 2020 issue and the 2026 paper exist and changed how people reason about MAVLink 2 as “solved.” [Uncertainty] How wide the 2020 scenario is remains a maintainer-vs-author dispute. [Inference — Moderate confidence] A Passport that records “signing on” without “time source” is incomplete.

**Opportunity.** Passport the time source for signing. Lab GPS-time vs storage-persistent timestamps. Watch Du et al. IEEE SIN 2024 (Mission Planner key update / seq / timestamp) as the GCS-side complement.

**LRRK relevance.** Sense-to-Control-Fabric. KAT should treat GNSS time as an input to link auth, not a given.

**Confidence.** High that both records exist. Medium on operational width.

## Forward indicators

1. A PX4 or ArduPilot release that refuses v1 and requires signing on non-USB links by default, not as a guide.
2. CISA or a CNA assigning a CVE to ExpressLRS 1.x/2.x or a successor phrase-bound RC link.
3. Independent re-test of CVE-2020-10283 on current PX4/ArduPilot builds.
4. Stock fix (not a journal countermeasure) for GPS-time vs MAVLink 2 anti-replay.
5. First Auterion or Holybro SKU named in a follow-on ICS advisory, not just “PX4.”

> **Collection integrity.** Retrospective special using NVD, CISA, IEEE, NCC, project docs and GHSA. No KEV hit. Excluded Rodday (March 2016, pre-window) and Humphreys 2012 as citations only. Excluded CVE-2026-26673 / CVE-2026-1743 (search snippets only, unverified). No exploit steps. QGC GHSA-v5rc-wh3c-c4cw (March 2026) is the nearest GCS parser case; no CVE found, not promoted to a signal.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C2</span></p>