A critical logic flaw in PX4 Autopilot versions 1.12.x through 1.15.x allows unauthenticated attackers or operators to trigger a dangerous flyaway condition during mode transitions.

The vulnerability resides in the mode switching mechanism, which fails to enforce a throttle threshold safety check when transitioning from Auto to Manual mode while the drone is in an ARMED state. This allows an unauthenticated user or external signal to induce a loss of control and rapid uncontrolled ascent.

The vulnerability poses a severe risk of physical property damage and potential total loss of the unmanned aerial vehicle. With a CVSS score of 8.1, the high severity reflects the potential for significant impact on system integrity and availability, as the flaw bypasses critical safety protocols necessary for flight stability.

Immediate Action: Operators should immediately review the official PX4 security guidance and apply the necessary firmware patches or logic corrections provided by the vendor.

Proactive Monitoring: Monitor flight logs for abnormal mode transition patterns, particularly those occurring during the post-landing or pre-disarm phase.

Compensating Controls: Implement strict operational procedures to ensure manual flight mode is only engaged when the system is in a safe, disarmed state or when altitude telemetry indicates the vehicle is stationary.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the vulnerability references.

Given the potential for physical destruction and the existence of a published proof-of-concept, users must prioritize the verification of their current firmware version. Organizations should treat this as a high-priority safety update and restrict flight operations until the patch is applied or the safety logic is confirmed to be mitigated.