A critical logic vulnerability in PX4 Autopilot versions 1.12.x through 1.15.x allows unauthenticated attackers to bypass pre-flight safety checks, potentially causing a loss of vehicle control.

The vulnerability exists within the Re-arm Grace Period logic, where the system incorrectly applies in-air emergency re-arm procedures to ground scenarios. This allows an unauthenticated user to bypass mandatory pre-flight safety checks by switching to Manual mode and re-arming within 5 seconds of an automatic landing.

The impact of this flaw is severe, as it enables unauthorized and unsafe operation of autonomous vehicles, leading to a direct risk of physical damage, property destruction, or total loss of the asset. With a CVSS score of 8.1, the vulnerability represents a high-risk security failure, specifically affecting the integrity and availability of the control systems. Organizations utilizing these autopilot versions face significant operational risks and potential liability due to the high likelihood of catastrophic system misuse.

Immediate Action: Review the official PX4 security advisory to identify the recommended firmware update, as a specific patch version is not explicitly listed in the provided data.

Proactive Monitoring: Monitor flight logs for instances of rapid mode transitions or re-arming sequences occurring immediately following automatic landing events.

Compensating Controls: Implement strict physical access controls to the ground control station and communication links to prevent unauthorized proximity-based interaction with the autopilot logic.

Public Exploit Available: No (There is no confirmed public exploit; the reference provided is a security researcher's write-up).

Given the potential for physical harm and loss of control, this vulnerability must be treated with high priority. Organizations should verify their current firmware version against the affected range and prepare for an emergency update cycle. Users should restrict operational access to authorized personnel only until the system has been patched to address the safety check bypass.