LC-2 · Software Danger Reports

LrrK Kinematic Software Danger Report

# LrrK Kinematic Software Danger Report

**LRRK Watch / Software Assurance** — Monthly filing.

| Field | Value |
| --- | --- |
| Collection cutoff | 31 March 2026 |
| Platform | Quiet Systems |
| Series | DKSR-M-2026-03 |
| Status | full |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Retrospective monthly. Image rights require separate verification before publication. |

## Executive read

### BLUF

March 2026 is when unsigned MAVLink becomes an ICS inventory item and the PX4 filesystem, battery CAN, and Zenoh bridge all get CVEs in the same week.

### Key judgments

1. **[Assessment — High confidence]** ICSA-26-090-02 / CVE-2026-1579 is the first CISA ICS advisory that treats PX4 missing link authentication as a critical function.
2. **[Assessment — High confidence]** CVE-2026-32709 (MAVLink FTP) is the filesystem complement of that unauthenticated peer.
3. **[Inference — Moderate confidence]** The 13 March GHSA cluster (32705–32709, 32713, 32724, 32743) is one campaign: default-trust MAVLink/RC/CAN, not eight unrelated bugs.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. ICSA-26-090-02 / CVE-2026-1579: unsigned MAVLink is a shell

*Event / publication dates: 31 March 2026 (CISA and NVD)*

| Field | Value |
| --- | --- |
| Component | software |
| Product | PX4 Autopilot v1.16.0_SITL_latest_stable (CISA product line) |
| CVE / advisory | CVE-2026-1579; ICSA-26-090-02 |
| Patch | partial — enable MAVLink 2 signing; hardening guide |
| Exploit status | advisory-only. CISA: no known public exploitation specifically targeting this. |
| Taxonomy | CWE-306 (CISA) · CAPEC-272 · ATT&CK ICS T1692.001 (T0855) · OWASP IoT I2 · EMB3D TID-406 |

**Verified record — [Fact — A1] https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 · https://nvd.nist.gov/vuln/detail/CVE-2026-1579**

**Exposure.** Interactive shell on the flight controller via unsigned SERIAL_CONTROL. Act with persistence.

**Intelligence assessment.** [Assessment — High confidence] First ICS treatment of the Kwon/2020 design fact. [Uncertainty] Version pin to one SITL string is oddly narrow.

**Opportunity.** Passport “signing required and v1 refused,” not “MAVLink 2 available.”

**LRRK relevance.** Control Fabric, Watch, Lab. Kestrel unsigned PX4 ports.

**Confidence.** High on the advisory. Moderate on SKU mapping.
## 02. CVE-2026-32709: unauthenticated MAVLink FTP

*Event / publication dates: GHSA 13 March 2026; NVD 16 March 2026*

| Field | Value |
| --- | --- |
| Component | software |
| Product | PX4-Autopilot prior to 1.17.0-rc2 |
| CVE / advisory | CVE-2026-32709; GHSA-fh32-qxj9-x32f |
| Patch | available — 1.17.0-rc2 |
| Exploit status | public writeup |
| Taxonomy | ATT&CK ICS T0814 · OWASP IoT I2 |
| Taxonomy | CWE-22 (GHSA) · CAPEC-126 · ATT&CK ICS T0836 · T0889 · OWASP IoT I2 · EMB3D TID-406 |

**Verified record — [Fact — A1] https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-fh32-qxj9-x32f · https://nvd.nist.gov/vuln/detail/CVE-2026-32709**

**Exposure.** Arbitrary file read/write/delete on the FC. Params, logs, keys, missions, geofences.

**Intelligence assessment.** [Assessment — High confidence] Filesystem trust on the same unauthenticated peer as signal 01. Scores disagree (GHSA 9.8 / CNA 5.4 / NVD 6.8).

**Opportunity.** Patch evidence is the rc2 tag. Passport FTP enabled/disabled.

**LRRK relevance.** Control Fabric. Campaign FTP-on across PX4 ports.

**Confidence.** High.
## 03. CVE-2026-32707: Tattu smart-battery CAN overflow

*Event / publication dates: GHSA 13 March 2026*

| Field | Value |
| --- | --- |
| Component | software |
| Product | PX4 ≤ 1.17.0-rc1 with tattu_can enabled; not default upstream |
| CVE / advisory | CVE-2026-32707; GHSA-wxwm-xmx9-hr32 |
| Patch | available — 1.17.0-rc2 or disable tattu_can |
| Exploit status | public writeup. Requires CAN injection (AV:P). |
| Taxonomy | CWE-121 (GHSA) · ATT&CK ICS T0814 · OWASP IoT I5 |

**Verified record — [Fact — A1] https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-wxwm-xmx9-hr32**

**Exposure.** BMS telemetry on the flight CAN can crash the autopilot. Field drop is not demonstrated.

**Intelligence assessment.** [Assessment — High confidence] First published BMS-driver CVE on PX4. [Uncertainty] Do not treat secondary “loss of control” write-ups as proven.

**Opportunity.** Passport tattu_can enabled and ≥ rc2.

**LRRK relevance.** Control Fabric on power. Sense (BMS) to Act (crash).

**Confidence.** High on the CVE. Low on in-flight drop.
## 04. CVE-2026-32708: Zenoh uORB stack VLA

*Event / publication dates: GHSA 13 March 2026; NVD 16 March 2026*

| Field | Value |
| --- | --- |
| Component | software |
| Product | PX4-Autopilot prior to 1.17.0-rc2 |
| CVE / advisory | CVE-2026-32708; GHSA-69g4-hcqf-j45p |
| Patch | available — 1.17.0-rc2 |
| Exploit status | public writeup |

**Verified record — [Fact — A1] https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-69g4-hcqf-j45p · https://nvd.nist.gov/vuln/detail/CVE-2026-32708**

**Exposure.** On-vehicle pub/sub middleware crash. Closest in-window ROS 2 / DDS-adjacent vehicle CVE.

**Intelligence assessment.** [Assessment — High confidence] Middleware is now on the CVE surface next to MAVLink.

**Opportunity.** Passport Zenoh/uORB enabled. Lab the bridge as a network-facing object.

**LRRK relevance.** Control Fabric. KAT from publisher to uORB.

**Confidence.** High.
## 05. CVE-2026-26673: DJI Enhanced-WiFi transmission DoS

*Event / publication dates: NVD 4 March 2026*

| Field | Value |
| --- | --- |
| Component | firmware |
| Product | DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 01.00.0500 and below |
| CVE / advisory | CVE-2026-26673 |
| Patch | none recorded (legacy/unsupported in related IDs) |
| Exploit status | catalogued |
| Taxonomy | ATT&CK ICS T0814 · OWASP IoT I2 |

**Verified record — [Fact — A1] https://nvd.nist.gov/vuln/detail/CVE-2026-26673**

**Exposure.** Radio availability on leftover Enhanced-WiFi. Not OcuSync, not Matrice.

**Intelligence assessment.** [Assessment — High confidence] Third ID in the 2025-09 / 2026-02 leftover-WiFi line. [Inference — Moderate confidence] Do not let this crowd out the PX4 ICS event in the same month.

**Opportunity.** Keep Enhanced-WiFi on its own Passport.

**LRRK relevance.** Control Fabric on leftover SKUs.

**Confidence.** High on CVE/date. Moderate on patch.

## Forward indicators

1. Auterion or Holybro SKU named in a follow-on ICS advisory.
2. A tagged PX4 release that is unambiguous across 32705/32706/32713/32724/32743 (same-month siblings, not promoted to signals).
3. ArduPilot SERIAL_CONTROL OOB publishing in July (fix merged this month as PR #32587).

> **Collection integrity.** Five signals ranked by cyber-physical trust, not CVE count. Additional same-month PX4 IDs (CVE-2026-32705, 32706, 32713, 32724, 32743) are verified and held as siblings. QGC GHSA-v5rc 404’d and is excluded. No KEV. No exploit steps.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C2</span></p>